26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T486,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSI.Agent Sample c7e4e3251b59… — Score 37/100 — Hybrid Analysis","description":"Malicious verdict for sample c7e4e3251b59…. Malware family: Trojan.MSI.Agent. Threat score 37/100. 5/24 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","keywords":["Malicious","Trojan.MSI.Agent","malware analysis","sandbox report","threat intelligence","c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58"],"about":{"@type":"SoftwareApplication","name":"appinst_ins008.msi","applicationCategory":["msi","data"],"identifier":"c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","additionalType":"Malicious sample"},"threatScore":37,"malwareFamily":"Trojan.MSI.Agent","antivirusDetections":{"malicious":5,"total":24},"behavioralIndicators":{"malicious":0,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8d5,"msiexec.exe" called "LoadResource with parameter {'hModule': '1936850946', 'hResInfo': '2032656'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791609769984', 'hResInfo': '8791612954320'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791609769984', 'hResInfo': '8791612954608'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791609769984', 'hResInfo': '8791612954272'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791609769984', 'hResInfo': '8791612954240'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '10682369', 'hResInfo': '7406296'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '7405569', 'hResInfo': '7495240'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791600332800', 'hResInfo': '8791600811320'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791600332800', 'hResInfo': '8791600810680'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791600332800', 'hResInfo': '8791600811208'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791600332800', 'hResInfo': '8791600810456'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791600332800', 'hResInfo': '8791600811224'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791600332800', 'hResInfo': '8791600810472'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791600332800', 'hResInfo': '8791600811240'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791600332800', 'hResInfo': '8791600810504'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791600332800', 'hResInfo': '8791600811256'}" (UID: 00000000-00002520) "msiexec.exe" called "LoadResource with parameter {'hModule': '8791600332800', 'hResInfo': '8791600810536'}" (UID: 00000000-00002520)28:T735,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "ServiceThreadMain: SetWaitableTimer failed." (Indicator: "SetWaitableTimer"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp")29:Te94,"msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHELL32.DLL (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.DLL (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.DLL (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\sxs.DLL (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCOREE.DLL (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\fusion.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTDLL.DLL (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002520) "msiexec.exe" called "LoadLibrary" with a parameter MsiHnd.dll (UID: 00000000-00002520)2a:T3c2e,"msiexec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SHGetPropertyStoreForWindow (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter PSStringFromPropertyKey (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter PropVariantToString (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter BufferedPaintRenderAnimation (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeTransitionDuration (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter BeginBufferedAnimation (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter EndBufferedAnimation (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter BufferedPaintStopAllAnimations (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SaferiChangeRegistryScope (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SaferGetLevelInformation (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcInitFwImports (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcInitImports (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcVerifierCorruptionExpected (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcExtInitializeExtensionPoint (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter ApphelpGetMsiProperties (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SdbInitDatabase (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SdbFindFirstMsiPackage_Str (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SdbReleaseDatabase (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter CheckElevationEnabled (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002520) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadExecutionState (UID: 00000000-00002520)2b:Tdd2,"SELECT `ComponentId` FROM `FeatureComponents`, `Component` WHERE `Component` = `Component_` AND `Feature_` = ?" (Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp, Indicator: "select `componentid` from `featurecomponents`, `component` where `component` = `component_` and `feature_` = ?") "SELECT `FileName`,`Version`,`State`,`File`.`Attributes`,`TempAttributes`,`File`,`FileSize`,`Language`,`Sequence`,`Directory_`,`Installed`,`Action`,`Component` FROM `File`,`Component` WHERE `Component`=`Component_` AND `Component_`=? AND `Directory_`=?" (Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp, Indicator: "select `filename`,`version`,`state`,`file`.`attributes`,`tempattributes`,`file`,`filesize`,`language`,`sequence`,`directory_`,`installed`,`action`,`component` from `file`,`component` where `component`=`component_` and `component_`=? and `directory_`=?") "SELECT `ComponentId` FROM `FeatureComponents`, `Component` WHERE `Component` = `Component_` AND `Feature_` = ?" (Source: 00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp, Indicator: "select `componentid` from `featurecomponents`, `component` where `component` = `component_` and `feature_` = ?") "SELECT `FileName`,`Version`,`State`,`File`.`Attributes`,`TempAttributes`,`File`,`FileSize`,`Language`,`Sequence`,`Directory_`,`Installed`,`Action`,`Component` FROM `File`,`Component` WHERE `Component`=`Component_` AND `Component_`=? AND `Directory_`=?" (Source: 00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp, Indicator: "select `filename`,`version`,`state`,`file`.`attributes`,`tempattributes`,`file`,`filesize`,`language`,`sequence`,`directory_`,`installed`,`action`,`component` from `file`,`component` where `component`=`component_` and `component_`=? and `directory_`=?") "SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` > 0 ORDER BY `Sequence`" (Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp, Indicator: "select `action`,null,`condition` from `installexecutesequence` where `sequence` > 0 order by `sequence`") "SELECT `Feature`, `Feature_Parent` FROM `Feature` WHERE (`Feature`.`Installed` = null OR `Feature`.`Installed` = 0) AND (`Feature`.`Action` = null OR `Feature`.`Action` = 0 OR `Feature`.`Action` = 3) AND `Feature`.`RuntimeLevel` > 0" (Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp, Indicator: "select `feature`, `feature_parent` from `feature` where (`feature`.`installed` = null or `feature`.`installed` = 0) and (`feature`.`action` = null or `feature`.`action` = 0 or `feature`.`action` = 3) and `feature`.`runtimelevel` > 0"), "SELECT `FileName` `Version` `State` `File`.`Attributes` `TempAttributes` `File` `FileSize` `Language` `Sequence` `Directory_` `Installed` `Action` `Component` `ForceLocalFiles` `ComponentId` NULL FROM `File` `Component` WHERE `Component`=`Component_` AND `File`=?" (Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp, Indicator: "select `filename` `version` `state` `file`.`attributes` `tempattributes` `file` `filesize` `language` `sequence` `directory_` `installed` `action` `component` `forcelocalfiles` `componentid` null from `file` `component` where `component`=`component_` and `file`=?")2c:Tbb9a,Found reference to API (Indicator: "GetLastError"; File: "appinst_ins008.msi") Found reference to API (Indicator: "IIDFromString"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CoDisconnectObject"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SysAllocStringLen"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SysFreeString"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SysStringLen"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "VariantClear"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "VariantInit"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "VariantChangeType"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SafeArrayCreate"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SafeArrayPutElement"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SafeArrayAccessData"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WNetGetResourceInformationW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WNetGetLastErrorW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegOpenUserClassesRoot"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegOpenCurrentUser"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateRestrictedToken"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateWaitableTimerW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CancelWaitableTimer"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "Thread32First"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "Thread32Next"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NtRenameKey"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NtOpenKey"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlCreateEnvironment"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlSetEnvironmentVariable"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlDestroyEnvironment"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlImageNtHeaderEx"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NtMapViewOfSection"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlCreateServiceSid"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WTSFreeMemory"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WTSQueryUserToken"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpConnect"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpReadData"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpSetOption"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpQueryAuthSchemes"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpSetCredentials"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateServiceW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "DeleteService"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetThreadToken"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OpenServiceW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetAce"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorLength"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegGetKeySecurity"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetServiceStatus"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "AddAccessAllowedAce"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RevertToSelf"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "MakeSelfRelativeSD"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegisterServiceCtrlHandlerW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "ReportEventW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetLengthSid"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "ControlService"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegSetValueExW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThread"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OpenProcess"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CompareStringW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetACP"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GlobalFree"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetFileType"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateEventW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpiW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OpenEventW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetVersion"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "PeekMessageW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "PostQuitMessage"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp, 00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CoDisconnectObject"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SysAllocString"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SysAllocStringLen"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SysStringLen"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "VariantClear"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "VariantInit"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "VariantChangeType"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SafeArrayCreate"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SafeArrayPutElement"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SafeArrayAccessData"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SafeArrayUnaccessData"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WNetGetResourceInformationW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WNetGetLastErrorW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetFileSecurityW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegOpenUserClassesRoot"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegOpenCurrentUser"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateRestrictedToken"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SHGetMalloc"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "DeleteUrlCacheEntryW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetThreadExecutionState"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateWaitableTimerW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CancelWaitableTimer"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CheckElevationEnabled"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlSetCurrentEnvironment"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NtRenameKey"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NtOpenKey"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlCreateEnvironment"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlSetEnvironmentVariable"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlDestroyEnvironment"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlImageNtHeaderEx"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NtMapViewOfSection"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlCreateServiceSid"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WTSEnumerateSessionsW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WTSFreeMemory"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WTSQueryUserToken"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NetGetJoinInformation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpSetOption"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpQueryAuthSchemes"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WinHttpSetCredentials"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "NotifyRedirectedStringChange"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateServiceW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegGetKeySecurity"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetServiceStatus"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "AddAccessAllowedAce"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegisterServiceCtrlHandlerW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp")2d:T9df,"HKLM\" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "HKCR\" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00004200.00000002.299211.001D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00004200.00000000.295368.001D0000.00000004.mdmp 00000000-00004200.00000001.297288.001D0000.00000004.mdmp 00000000-00004200.00000002.299211.001D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\C" in Source: 00000000-00004488.00000000.293782.01670000.00000004.mdmp 00000000-00004488.00000001.295707.01670000.00000004.mdmp 00000000-00004488.00000002.297628.01670000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004488.00000000.293782.01670000.00000004.mdmp "HKU\" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "HKCU\" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "Software\Classes\Installer" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "EGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004488.00000001.295707.003E0000.00000004.mdmp 00000000-00004488.00000002.297628.003E0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Mic" in Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp 00000000-00004488.00000002.297628.01670000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18" in Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp 00000000-00004488.00000002.297628.01670000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6050B110-CE87-4126-A114-50AEFCFC95F8}\Forward" in Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp 00000000-00004488.00000002.297628.01670000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6050B110-CE87-4126-A114-50AEFCFC95F8}\Forward" in Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp 00000000-00004488.00000002.297628.01670000.00000004.mdmp2e:Tc11,"\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00004200.00000000.295368.001D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00004200.00000001.297288.001D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00004200.00000002.299211.001D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\C" in Source: 00000000-00004488.00000000.293782.01670000.00000004.mdmp "System\CurrentControlSet\Control\Session Manager\Environment" in Source: 00000000-00004488.00000000.293782.01670000.00000004.mdmp "HKU\" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "HKLM\" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "HKCU\" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "HKCR\" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "Software\Classes\Installer" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp "EGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004488.00000001.295707.003E0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\C" in Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp "HKEY_CURRENT_USER\Software\Mic" in Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18" in Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6050B110-CE87-4126-A114-50AEFCFC95F8}\Forward" in Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6050B110-CE87-4126-A114-50AEFCFC95F8}\Forward" in Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp "EGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\C" in Source: 00000000-00004488.00000002.297628.01670000.00000004.mdmp "HKEY_CURRENT_USER\Software\Mic" in Source: 00000000-00004488.00000002.297628.01670000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18" in Source: 00000000-00004488.00000002.297628.01670000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6050B110-CE87-4126-A114-50AEFCFC95F8}\Forward" in Source: 00000000-00004488.00000002.297628.01670000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6050B110-CE87-4126-A114-50AEFCFC95F8}\Forward" in Source: 00000000-00004488.00000002.297628.01670000.00000004.mdmp2f:Tb89,"" (Indicator: ".ost") in Source: 00000000-00004488.00000001.295707.03EBD000.00000004.mdmp 00000000-00004488.00000002.297628.03EBD000.00000004.mdmp30:Ta1c,"msiexec.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fef3920000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7feff490000 "msiexec.exe" loaded module "CRYPTSP.DLL" at base 7fefcb30000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fefc830000 "msiexec.exe" loaded module "ADVAPI32.DLL" at base 7fefd700000 "msiexec.exe" loaded module "CRYPTBASE.DLL" at base 7fefd1a0000 "msiexec.exe" loaded module "COMCTL32" at base 7fefbd60000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 77430000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fefb8f0000 "msiexec.exe" loaded module "DWMAPI.DLL" at base 7fefb2e0000 "msiexec.exe" loaded module "COMCTL32.DLL" at base 7fefbd60000 "msiexec.exe" loaded module "UXTHEME.DLL" at base 7fefb8f0000 "msiexec.exe" loaded module "CLBCATQ.DLL" at base 7feff0c0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7feff700000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7fefd9e0000 "msiexec.exe" loaded module "OLE32.DLL" at base 7feff490000 "msiexec.exe" loaded module "PROPSYS.DLL" at base 7fefbad0000 "msiexec.exe" loaded module "OLEAUT32.DLL" at base 7fefe770000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 7fefb300000 "msiexec.exe" loaded module "RPCRT4.DLL" at base 7fefea30000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fefd700000 "msiexec.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 7fefd980000 "msiexec.exe" loaded module "RPCRTREMOTE.DLL" at base 7fefd290000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 7fef4c70000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7fefd140000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fefc420000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 7fef3320000 "msiexec.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fef9740000 "msiexec.exe" loaded module "KERNEL32" at base 77430000 "msiexec.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7fef2360000 "msiexec.exe" loaded module "SHLWAPI.DLL" at base 7fefef00000 "msiexec.exe" loaded module "VERSION.DLL" at base 7fefc420000 "msiexec.exe" loaded module "PROFAPI.DLL" at base 7fefd350000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 77650000 "msiexec.exe" loaded module "SSPICLI.DLL" at base 7fefd110000 "msiexec.exe" loaded module "MSIHND.DLL" at base 7fef437000031:T4e9,"1800190000000000203596f3fe070000@api-ms-win-core-synch-l1-2-0.dll" "1800190000000000403596f3fe070000@api-ms-win-core-synch-l1-2-0.dll" "0d000e0000000000a89195f3fe070000@ntdll.dll" "0600070000000000845df1f4fe070000@SHLWAPI.dll" "150016000000000050753df3fe070000@ADVAPI32.dll" "0e000f000000000020763df3fe070000@ADVAPI32.dll" "0e000f000000000090763df3fe070000@ADVAPI32.dll" "1100120000000000b0803df3fe070000@ADVAPI32.dll" "110012000000000060813df3fe070000@ADVAPI32.dll" "1200130000000000b0813df3fe070000@ADVAPI32.dll" "120013000000000020823df3fe070000@ADVAPI32.dll" "140015000000000088be3df3fe070000@ADVAPI32.dll" "1400150000000000a8be3df3fe070000@ADVAPI32.dll" "1400150000000000c8be3df3fe070000@ADVAPI32.dll" "1700180000000000e8be3df3fe070000@ADVAPI32.dll" "0d000e000000000008bf3df3fe070000@ADVAPI32.dll" "110012000000000018bf3df3fe070000@ADVAPI32.dll" "110012000000000030bf3df3fe070000@ADVAPI32.dll" "0d000e000000000088823df3fe070000@SHELL32.dll" "0d000e000000000018833df3fe070000@SHELL32.dll" "0f00100000000000c8c03df3fe070000@ADVAPI32.dll" "140015000000000020c13df3fe070000@ADVAPI32.dll" "140015000000000040c13df3fe070000@ADVAPI32.dll" "0c000d0000000000a0c13df3fe070000@ADVAPI32.dll" "0c000d0000000000b0c13df3fe070000@ADVAPI32.dll"32:T901,"msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ".") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "..") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "0409") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ADVANCEDINSTALLERS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPMGMT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPRAISER") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BOOT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CATROOT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CATROOT2") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CODEINTEGRITY") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "COM") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "COMPATTEL") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CONFIG") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CONFIGURATION") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DISM") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DRIVERS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DRIVERSTORE") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DRVSTORE") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DSC") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FXSTMP") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "GROUPPOLICY") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "GROUPPOLICYUSERS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IAS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ICSXML") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "IME")33:Td9e,Observed system executable string:"C:\Windows\system32\kernel32.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\ADVAPI32.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\msvcrt.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\RPCRT4.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\SYSTEM32\sechost.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\GDI32.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\USP10.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\ole32.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\SHLWAPI.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\AppPatch\AppPatch64\AcLayers.DLL" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\sfc_os.DLL" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"\Windows\system32\profapi.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\IMM32.DLL" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\OLEAUT32.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\ucrtbase.DLL" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\WS2_32.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\CRYPTBASE.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\CLBCatQ.DLL" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\sfc.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\AppPatch\AppPatch64\AcGenral.DLL" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\Temp\VxOle64.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp]34:T41d,Found reference to API "RtlCreateServiceSid" (Indicator: "CreateService"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "CreateServiceW" (Indicator: "CreateService"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "RegisterServiceCtrlHandler failed." (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "RtlCreateServiceSid" (Indicator: "CreateService"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "CreateServiceW" (Indicator: "CreateService"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp")35:T778,"msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\INSTALLER"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\MANAGED\S-1-5-21-686412048-2446563785-1323799475-1001\INSTALLER\PRODUCTS"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\MANAGED\S-1-5-21-686412048-2446563785-1323799475-1001\INSTALLER\PRODUCTS\38272B296B83B6C42BB3D39E204FEF7A"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\38272B296B83B6C42BB3D39E204FEF7A"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\MANAGED\S-1-5-21-686412048-2446563785-1323799475-1001\INSTALLER\PRODUCTS\4E0BD19BF736E9643890D096DF811A5E"; Key: ""; Value: "")36:Tdf4,"msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\38272B296B83B6C42BB3D39E204FEF7A"; Key: "PACKAGECODE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\38272B296B83B6C42BB3D39E204FEF7A"; Key: "INSTANCETYPE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\4E0BD19BF736E9643890D096DF811A5E"; Key: "PACKAGECODE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\4E0BD19BF736E9643890D096DF811A5E"; Key: "INSTANCETYPE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\7957AACB8FFDE6A4E8402FF5B2050A40"; Key: "PACKAGECODE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\7957AACB8FFDE6A4E8402FF5B2050A40"; Key: "INSTANCETYPE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\8400E080C358BF9469DE03ED7FBAE643"; Key: "PACKAGECODE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\8400E080C358BF9469DE03ED7FBAE643"; Key: "INSTANCETYPE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\842D63DCC63F5354799AC97B4B0E1C68"; Key: "PACKAGECODE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\842D63DCC63F5354799AC97B4B0E1C68"; Key: "INSTANCETYPE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\88A02357F934A7948B65FF93E77D2130"; Key: "PACKAGECODE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\88A02357F934A7948B65FF93E77D2130"; Key: "INSTANCETYPE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\893F179D11F76594BA37F17BE0951AF1"; Key: "PACKAGECODE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\893F179D11F76594BA37F17BE0951AF1"; Key: "INSTANCETYPE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\A6D967747491F6B4B9F28E182F40ACA5"; Key: "PACKAGECODE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\A6D967747491F6B4B9F28E182F40ACA5"; Key: "INSTANCETYPE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INSTALLER\PRODUCTS\B5FEBF0A529B68F4B9057A1375634C18"; Key: "PACKAGECODE"; Value: "")37:T725,"msiexec.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\msi.dll" "msiexec.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "msiexec.exe" trying to touch file "C:\Windows\AppPatch\AppPatch64\AcLayers.DLL" "msiexec.exe" trying to touch file "C:\Windows\System32\WINSPOOL.DRV" "msiexec.exe" trying to touch file "C:\Windows\System32\MPR.dll" "msiexec.exe" trying to touch file "C:\Windows\AppPatch\AppPatch64\AcGenral.DLL" "msiexec.exe" trying to touch file "C:\Windows\System32\SspiCli.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\sfc.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\sfc_os.DLL" "msiexec.exe" trying to touch file "C:\Windows\System32\dwmapi.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\msiexec.exe.Config" "msiexec.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "msiexec.exe" trying to touch file "C:\Windows\System32\msiexec.exe.Local\" "msiexec.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757" "msiexec.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\COMCTL32.DLL" "msiexec.exe" trying to touch file "C:\Windows\system32\TSAPPCMP.DLL" "msiexec.exe" trying to touch file "C:\Windows\Temp\VxSSL64.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\FLTLIB.DLL" "msiexec.exe" trying to touch file "C:\Windows\System32\MSVCP140.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\VCRUNTIME140.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\api-ms-win-crt-runtime-l1-1-0.dll" "msiexec.exe" trying to touch file "C:\Windows\System32\ucrtbase.DLL"38:T570,"msiexec.exe" trying to access non-existent file "C:\Windows\system32\TSAPPCMP.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-datetime-l1-1-1.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-obsolete-l1-2-0.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\TSAPPCMP.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-DATETIME-L1-1-1.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL"39:T429,Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WNetGetResourceInformationW" (Indicator: "WNetGetResourceInformation"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WNetGetResourceInformationW" (Indicator: "WNetGetResourceInformation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp")3a:T971,Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp")3b:Tf8b,Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp")3c:T12d6,Found string "ncalrpc" (Indicator: "ncalrpc"; File: "00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "A+ncalrpc:[OLE06AEA8D18CA24F7F845FBFB6549A]" (Indicator: "ncalrpc"; File: "00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "B+ncalrpc:[OLE84A240BEF8724262941D925CEA13]" (Indicator: "ncalrpc"; File: "00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; File: "00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "-+ncalrpc:[OLE3E091821566940928FE35E81AE00]" (Indicator: "ncalrpc"; File: "00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "-+ncalrpc:[OLEDADB7C27A18248DB81D29A660A4D]" (Indicator: "ncalrpc"; File: "00000000-00004200.00000002.299211.001D0000.00000004.mdmp") Found string "B+ncalrpc:[OLE3E091821566940928FE35E81AE00]" (Indicator: "ncalrpc"; File: "00000000-00004200.00000002.299211.001D0000.00000004.mdmp") Found string "=9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; File: "00000000-00004200.00000002.299211.001D0000.00000004.mdmp") Found string "+ncalrpc:[OLE3E091821566940928FE35E81AE00]" (Indicator: "ncalrpc"; File: "00000000-00004200.00000002.299211.001D0000.00000004.mdmp") Found string "+ncalrpc:[OLEDADB7C27A18248DB81D29A660A4D]" (Indicator: "ncalrpc"; Source: "00000000-00004200.00000000.295368.001D0000.00000004.mdmp, 00000000-00004200.00000001.297288.001D0000.00000004.mdmp, 00000000-00004200.00000002.299211.001D0000.00000004.mdmp") Found string "B+ncalrpc:[OLE3E091821566940928FE35E81AE00]" (Indicator: "ncalrpc"; Source: "00000000-00004200.00000000.295368.001D0000.00000004.mdmp, 00000000-00004200.00000001.297288.001D0000.00000004.mdmp, 00000000-00004200.00000002.299211.001D0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00004200.00000000.295368.001D0000.00000004.mdmp, 00000000-00004200.00000001.297288.001D0000.00000004.mdmp, 00000000-00004200.00000002.299211.001D0000.00000004.mdmp") Found string "+ncalrpc:[OLE3E091821566940928FE35E81AE00]" (Indicator: "ncalrpc"; Source: "00000000-00004200.00000000.295368.001D0000.00000004.mdmp, 00000000-00004200.00000001.297288.001D0000.00000004.mdmp, 00000000-00004200.00000002.299211.001D0000.00000004.mdmp") Found string "+ncalrpc:[OLE06AEA8D18CA24F7F845FBFB6549A]" (Indicator: "ncalrpc"; Source: "00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "+ncalrpc:[OLE5F27E5DB36D6437A996ADD793641]" (Indicator: "ncalrpc"; Source: "00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "+ncalrpc:[OLE84A240BEF8724262941D925CEA13]" (Indicator: "ncalrpc"; Source: "00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "+ncalrpc:[OLE3E091821566940928FE35E81AE00]" (Indicator: "ncalrpc"; Source: "00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "+ncalrpc:[OLEFA34CC692740456380571BA29E59]" (Indicator: "ncalrpc"; Source: "00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp") Found string "B+ncalrpc:[OLE84A240BEF8724262941D925CEA13]" (Indicator: "ncalrpc"; Source: "00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp") Found string "I+ncalrpc:[OLEFA34CC6927" (Indicator: "ncalrpc"; Source: "00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp") Found string "+ncalrpc:[OLEF0A757155ACE48ED8EF13DD3AB81]" (Indicator: "ncalrpc"; Source: "00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp") Found string "+ncalrpc:[OLEDADB7C27A18248DB81D29A660A4D]" (Indicator: "ncalrpc"; Source: "00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp") Found string "B+ncalrpc:[OLE5F27E5DB36D6437A996ADD793641]" (Indicator: "ncalrpc"; Source: "00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp")3d:T42b,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "NetGetJoinInformation" (Indicator: "NetGetJoinInformation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp")3e:T42f,"msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "700107a9" "cx": "32" "cy": "32"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "400109bf" "cx": "398" "cy": "25"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "700107a9" "cx": "16" "cy": "16"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "400109bf" "cx": "16" "cy": "16"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "39010a48" "cx": "398" "cy": "25"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "400109bf" "cx": "90" "cy": "23"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "39010a48" "cx": "90" "cy": "23"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "39010a48" "cx": "32" "cy": "32"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "39010a48" "cx": "16" "cy": "16"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "700107a9" "cx": "398" "cy": "25"}3f:T48f,"msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002520) "msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00002520) "msiexec.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002520) "msiexec.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002520) "msiexec.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002520) "msiexec.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002520) "msiexec.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002520) "msiexec.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002520) "msiexec.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002520) "msiexec.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002520) "msiexec.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002520) "msiexec.exe" called "FindFirstFileW" with parameter C:\appinst_ins008.msi (UID: 00000000-00002520)40:T922,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp")41:T4c4,Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp")42:T49a,Found registry deletion API: "WRPRegDeleteKey" in file "00000000-00004488.00000002.297628.003E0000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyExW" in file "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyW" in file "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW" in file "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp" Found registry deletion API: "WRPRegDeleteKey" in "00000000-00004200.00000000.295368.001D0000.00000004.mdmp, 00000000-00004200.00000001.297288.001D0000.00000004.mdmp, 00000000-00004200.00000002.299211.001D0000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp" Found registry deletion API: "WRPRegDeleteKey" in "00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp"43:Tb10,Found string "\Device\HarddiskVolume2\Windows\System32\msiexec.exe" (Indicator: "\Device\"; File: "00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "indows\system32\spool\drivers\x64\3\en-us" (Indicator: "\drivers\"; File: "00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00004200.00000000.295368.001D0000.00000004.mdmp, 00000000-00004200.00000001.297288.001D0000.00000004.mdmp, 00000000-00004200.00000002.299211.001D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp") Found string "ndows\system32\spool\drivers\x64\3\en-us" (Indicator: "\drivers\"; Source: "00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000001.295707.03EBD000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.03EBD000.00000004.mdmp") Found string "32\spool\drivers\x64\3\en-us" (Indicator: "\drivers\"; Source: "00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000001.295707.03EBD000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.03EBD000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp") Found string "ndows\system32\drivers" (Indicator: "system32\drivers"; Source: "00000000-00004488.00000001.295707.03EBD000.00000004.mdmp, 00000000-00004488.00000002.297628.03EBD000.00000004.mdmp") Found string "32\drivers\en-us" (Indicator: "\drivers\"; Source: "00000000-00004488.00000001.295707.03EBD000.00000004.mdmp, 00000000-00004488.00000002.297628.03EBD000.00000004.mdmp") Found string "ndows\system32\drivers\en-us" (Indicator: "\drivers\"; Source: "00000000-00004488.00000001.295707.03EBD000.00000004.mdmp, 00000000-00004488.00000002.297628.03EBD000.00000004.mdmp") Found string "ndows\system32\drivers\en-us" (Indicator: "system32\drivers"; Source: "00000000-00004488.00000001.295707.03EBD000.00000004.mdmp, 00000000-00004488.00000002.297628.03EBD000.00000004.mdmp") Found string "spool\drivers\x64\3\en-us" (Indicator: "\drivers\"; Source: "00000000-00004488.00000001.295707.03EBD000.00000004.mdmp, 00000000-00004488.00000002.297628.03EBD000.00000004.mdmp")44:Te59,Found reference to API "CoRevertToSelf" (Indicator: "RevertToSelf"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetSecurityDescriptorOwner" (Indicator: "GetSecurityDescriptorOwner"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "CoRevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "CreateRestrictedToken" (Indicator: "CreateRestrictedToken"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":37,"unified_at_epoch_ms":1791644622732,"unified_at":"2026-10-10T15:03:42.732Z","metadata":{"hashes":{"sha256":"c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","sha1":"f78d3ef5501737f73f39aad6717efe8ba2fd03ae","md5":"052f0a278ebcd64ef95e1ab998a6db02","sha512":"5918e564ac95b12c62ac2ae785bf36d75460c6774f57c14515b9305c5eea87a73cc32d2ae12f1b180466ea2db3fe9cafcc313fb174f610e7f1b3ae79d22cbb2d","ssdeep":"196608:gwHlJcQNPfm2NNzwSbpy7fNh/ruIEzUmplqsjG8AozrKOLSb6Ma:H0QNfNESb4bNh/NEzJHqsjGPozrdS2Ma","ssdeep_chunks":["196608:gwHlJcQ","196608:wHlJcQN","196608:HlJcQNP","196608:lJcQNPf","196608:JcQNPfm","196608:cQNPfm2","196608:QNPfm2N","196608:NPfm2NN","196608:Pfm2NNz","196608:fm2NNzw","196608:m2NNzwS","196608:2NNzwSb","196608:NNzwSbp","196608:NzwSbpy","196608:zwSbpy7","196608:wSbpy7f","196608:Sbpy7fN","196608:bpy7fNh","196608:py7fNh/","196608:y7fNh/r","196608:7fNh/ru","196608:fNh/ruI","196608:Nh/ruIE","196608:h/ruIEz","196608:/ruIEzU","196608:ruIEzUm","196608:uIEzUmp","196608:IEzUmpl","196608:EzUmplq","196608:zUmplqs","196608:Umplqsj","196608:mplqsjG","196608:plqsjG8","196608:lqsjG8A","196608:qsjG8Ao","196608:sjG8Aoz","196608:jG8Aozr","196608:G8AozrK","196608:8AozrKO","196608:AozrKOL","196608:ozrKOLS","196608:zrKOLSb","196608:rKOLSb6","196608:KOLSb6M","196608:OLSb6Ma","393216:gwHlJcQ","393216:wHlJcQN","393216:HlJcQNP","393216:lJcQNPf","393216:JcQNPfm","393216:cQNPfm2","393216:QNPfm2N","393216:NPfm2NN","393216:Pfm2NNz","393216:fm2NNzw","393216:m2NNzwS","393216:2NNzwSb","393216:NNzwSbp","393216:NzwSbpy","393216:zwSbpy7","393216:wSbpy7f","393216:Sbpy7fN","393216:bpy7fNh","393216:py7fNh/","393216:y7fNh/r","393216:7fNh/ru","393216:fNh/ruI","393216:Nh/ruIE","393216:h/ruIEz","393216:/ruIEzU","393216:ruIEzUm","393216:uIEzUmp","393216:IEzUmpl","393216:EzUmplq","393216:zUmplqs","393216:Umplqsj","393216:mplqsjG","393216:plqsjG8","393216:lqsjG8A","393216:qsjG8Ao","393216:sjG8Aoz","393216:jG8Aozr","393216:G8AozrK","393216:8AozrKO","393216:AozrKOL","393216:ozrKOLS","393216:zrKOLSb","393216:rKOLSb6","393216:KOLSb6M","393216:OLSb6Ma","196608:H0QNfNE","196608:0QNfNES","196608:QNfNESb","196608:NfNESb4","196608:fNESb4b","196608:NESb4bN","196608:ESb4bNh","196608:Sb4bNh/","196608:b4bNh/N","196608:4bNh/NE","196608:bNh/NEz","196608:Nh/NEzJ","196608:h/NEzJH","196608:/NEzJHq","196608:NEzJHqs","196608:EzJHqsj","196608:zJHqsjG","196608:JHqsjGP","196608:HqsjGPo","196608:qsjGPoz","196608:sjGPozr","196608:jGPozrd","196608:GPozrdS","196608:PozrdS2","196608:ozrdS2M","196608:zrdS2Ma"],"imphash":"Unknown"},"file_info":{"file_name":"appinst_ins008.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":8089600,"entropy":8,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1786691551000,"last_seen":1787846918000,"last_multi_scan":1787846918000}},"detections":{"summary":{"verdict":"malicious","score":37,"tags":null},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":156,"suspicious_count":4,"malicious_count":0,"total":160},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.FakeApp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Suspicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"ABmRisk.IZJN-","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.MSI.Agent.JUM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.MSI.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"suspicious","value":"Able to access VSS COM Interface object"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Scans for the windows taskbar (may be used for explorer injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","identifiers":[{"type":"suspicious","value":"Drops non-PE file with executable file extension"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Opens a handle to the specified process"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"},{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Identified known pipe name"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ifgx.mz\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"4.0.5.0\" found in string \"WiX Toolset (4.0.5.0)\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"NtMapViewOfSection\" (Indicator: \"NtMapViewOfSection\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"NtMapViewOfSection\" (Indicator: \"NtMapViewOfSection\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found string \"DeleteService\" (Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"msiexec.exe\" called \"RemoveDirectoryW\" with parameter C:\\MSId4d7a.tmp (UID: 00000000-00002520)\n \"msiexec.exe\" called \"RemoveDirectoryW\" with parameter Z:\\MSId4d7b.tmp (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken failed with %d\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"SetThreadToken\" (Indicator: \"SetThreadToken\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"ControlService failed.\" (Indicator: \"ControlService\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"OpenService failed.\" (Indicator: \"OpenService\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"msiexec.exe\" queried SystemProcessInformation at 00000000-00004488-00000033-14550029 [PID: 4488]\n \"msiexec.exe\" queried SystemProcessInformation at 00000000-00004488-00000033-14550347 [PID: 4488]\n \"MsiExec.exe\" queried SystemProcessInformation at 00000000-00004200-00000033-710020 [PID: 4200]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found api reference \"CertDuplicateCertificateContext\" (Indicator: \"CertDuplicateCertificateContext\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor al\n byte ptr [ebx+71h] in Stream UID: 00000000-00004488-20755-4735-00473C48\n Assembly shows XOR instruction xor dword ptr [eax]\n BAB9C77Bh in Stream UID: 00000000-00004488-20755-4735-00473C48\n Assembly shows XOR instruction xor al\n B2h in Stream UID: 00000000-00004488-20755-4735-00473C48\n Assembly shows XOR instruction xor eax\n 15111A44h in Stream UID: 00000000-00004488-20755-4735-00473C48","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004200.00000000.295368.001D0000.00000004.mdmp, 00000000-00004200.00000001.297288.001D0000.00000004.mdmp, 00000000-00004200.00000002.299211.001D0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004488.00000001.295707.003E0000.00000004.mdmp, 00000000-00004488.00000002.297628.003E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.98704","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002520-00000C2C-3592118278\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002520-00000C2C-3592118278\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002520-00000C2C-3587157165\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002520-00000C2C-3587157321\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002520-00000C2C-3588912393\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in file \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"msiexec.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"msiexec.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"msiexec.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"msiexec.exe\" called \"IsWow64Process\" with parameter \"2520\" - (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"msiexec.exe\" called \"GetWindowTextW\" (UID: 00000000-00002520)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Preparing to install...\" - (UID: 00000000-00002520)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00002520)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Please wait while Windows configures UNITAT Licensing Dll\" - (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"msiexec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"msiexec.exe\" called \"RtlGetVersion\" with parameter 1401000006000000000000007017000002000000000065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"msiexec.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"msiexec.exe\" called \"FileTimeToLocalFileTime\" with parameter 00cae4e7c72bdd01 & 00cae4e7c72bdd01 (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"msiexec.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"msiexec.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"msiexec.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\5651380B68661586C9476E7F935A1059\\INSTALLPROPERTIES\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00002520-00000046-2204106\n \"msiexec.exe\" queries volume information of \"C:\\share\" at 00000000-00002520-00000046-6521532\n \"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00004488-00000046-5063814\n \"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00004488-00000046-5064594","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"OpenSCManager failed.\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"msiexec.exe\" called \"CreateDirectoryW\" with parameter C:\\ProgramData (UID: 00000000-00002520)\n \"msiexec.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates (UID: 00000000-00002520)\n \"msiexec.exe\" called \"CreateDirectoryW\" with parameter C:\\Windows (UID: 00000000-00002520)\n \"msiexec.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\Fonts (UID: 00000000-00002520)\n \"msiexec.exe\" called \"CreateDirectoryW\" with parameter C:\\MSId4d7a.tmp (UID: 00000000-00002520)\n \"msiexec.exe\" called \"CreateDirectoryW\" with parameter Z:\\MSId4d7b.tmp (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$29","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"msiexec.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"appinst_ins008.msi\")\n Found reference to API \"WNetGetLastErrorW\" (Indicator: \"GetLastError\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WNetGetLastErrorW\" (Indicator: \"GetLastError\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcher failed.\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcher failed.\" (Indicator: \"StartService\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process msiexec.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute\"\n Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n Process MsiExec.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\26f3475fc22\"\n Process MsiExec.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\{4368208F-BCAC-11D2-A919-00C04FB98638}\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"todop.exe\" as clean (type is \"ASCII text with no line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"msiexec.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"msiexec.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"msiexec.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-2.dll\" - [base:0; Status:c0000135]\n \"msiexec.exe\" failed to load missing module \"api-ms-win-appmodel-runtime-l1-1-0.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FCC80000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FC770000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at EE2D0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at EEDA0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FEA30000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FEA30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"appinst_ins008.msi\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"appinst_ins008.msi\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"msiexec.exe\" touched \"Msi install server\" (Path: \"HKCU\\CLSID\\{000C101C-0000-0000-C000-000000000046}\")\n \"msiexec.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{000C103E-0000-0000-C000-000000000046}\")\n \"msiexec.exe\" touched \"Microsoft Windows Installer Message RPC\" (Path: \"HKCU\\CLSID\\{000C101D-0000-0000-C000-000000000046}\\DLLVERSION\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume2\\Windows\\System32\\msiexec.exe\" [Source: 00000000-00004488.00000002.297628.003E0000.00000004.mdmp]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"msiexec.exe\" (UID: 00000000-00004488) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles\"\n Process \"msiexec.exe\" (UID: 00000000-00004488) was launched with missing environment variables: \"LOGONSERVER, PROMPT, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE\"\n Process \"MsiExec.exe\" (UID: 00000000-00004200) was launched with new environment variables: \"LOGONSERVER=\"%HOSTNAME%\", HOMEPATH=\"\\Users\\j535aVe\", HOMEDRIVE=\"C:\"\"\n Process \"MsiExec.exe\" (UID: 00000000-00004200) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, TEMP, USERPROFILE, TMP\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$32","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"msiexec.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00004488)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding B238BAFC8546CF4254575F5627155153 E Global\\\\MSI0000\" (UID: 00000000-00004200)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00004488)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding B238BAFC8546CF4254575F5627155153 E Global\\\\MSI0000\" (UID: 00000000-00004200)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"msiexec.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"todop.exe\" has type \"ASCII text with no line terminators\"- [targetUID: N/A]\n \"MSI385F.tmp\" has type \"data\"- [targetUID: N/A]\n \"36776ec6.rbs\" has type \"data\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"MSI385F.tmp\" has type \"data\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"msiexec.exe\" opens a process \"C:\\Windows\\System32\\msiexec.exe\" (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"msiexec.exe\" queries basic process information of the \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (UID: 2520)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"msiexec.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"System\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"00000000-00004488.00000000.293782.01670000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\"msiexec.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1055.011","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"msiexec.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Templates\"\n \"msiexec.exe\" touched file \"C:\\Windows\\Fonts\"\n \"msiexec.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"msiexec.exe\" trying to access non-existent file \"C:\\Windows\\System32\\msiexec.exe.Config\"\n \"msiexec.exe\" trying to access non-existent file \"C:\\Windows\\System32\\msiexec.exe.Local\\\"\n \"msiexec.exe\" trying to access non-existent file \"A:\"\n \"msiexec.exe\" trying to access non-existent file \"B:\"\n \"msiexec.exe\" trying to access non-existent file \"D:\"\n \"msiexec.exe\" trying to access non-existent file \"E:\"\n \"msiexec.exe\" trying to access non-existent file \"F:\"\n \"msiexec.exe\" trying to access non-existent file \"G:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 0, G\" (Indicator: \"ping \"; Source: \"00000000-00004488.00000000.293782.01670000.00000004.mdmp, 00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"msiexec.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToCacheFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00004200.00000000.295368.00DE0000.00000002.mdmp, 00000000-00004200.00000001.297288.00DE0000.00000002.mdmp, 00000000-00004200.00000002.299211.00DE0000.00000002.mdmp\")\n Found reference to API \"Failed to connect to server. Error: 0x%X\" (Indicator: \" connect \"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00002520-00000CCE-3588729203\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; File: \"00000000-00004488.00000002.297628.003E0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004200.00000000.295368.001D0000.00000004.mdmp, 00000000-00004200.00000001.297288.001D0000.00000004.mdmp, 00000000-00004200.00000002.299211.001D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenUserClassesRoot\" in file \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found registry query API: \"RegOpenCurrentUser\" in file \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found registry query API: \"RegEnumKeyW\" in file \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found registry query API: \"RegOpenUserClassesRoot\" in \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found registry query API: \"RegOpenCurrentUser\" in \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found registry query API: \"RegEnumKeyW\" in \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"\n Found registry query API: \"RegEnumKeyExW\" in \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"$3e","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"msiexec.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"msiexec.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff070000030000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \":\\windows\\microsoft.net\\assembly\\gac_msil\\system.security.cryptography.primitives\\v4.0_4.0.0.0__b03f5f7f11d50a3a\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00004488.00000001.295707.03EBD000.00000004.mdmp, 00000000-00004488.00000002.297628.03EBD000.00000004.mdmp\")\n Found string \"ndows\\microsoft.net\\assembly\\gac_msil\\system.security.cryptography.primitives\\v4.0_4.0.0.0__b03f5f7f11d50a3a\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00004488.00000001.295707.03EBD000.00000004.mdmp, 00000000-00004488.00000002.297628.03EBD000.00000004.mdmp\")\n Found string \"indows\\microsoft.net\\assembly\\gac_msil\\system.security.cryptography.primitives\\v4.0_4.0.0.0__b03f5f7f11d50a3a\" (Indicator: \"System.Security.Cryptography\"; Source: \"00000000-00004488.00000001.295707.03EBD000.00000004.mdmp, 00000000-00004488.00000002.297628.03EBD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-117","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping 0, G\" (Indicator: \"ping\"; Source: \"00000000-00004488.00000000.293782.01670000.00000004.mdmp, 00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"msiexec.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002520)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$43","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"SeTakeOwnershipPrivilege\" (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp, 00000000-00004488.00000001.295707.01670000.00000004.mdmp, 00000000-00004488.00000002.297628.01670000.00000004.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"msiexec.exe\" opened \"\\Device\\KsecDD\"\n \"MsiExec.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"msiexec.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\LANMANWORKSTATION\\PARAMETERS\"; Key: \"RPCCACHETIMEOUT\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Attempts to access unusual system drive letters","description":"\"msiexec.exe\" touched \"K:\"\n \"msiexec.exe\" touched \"L:\"\n \"msiexec.exe\" touched \"M:\"\n \"msiexec.exe\" touched \"N:\"\n \"msiexec.exe\" touched \"O:\"\n \"msiexec.exe\" touched \"P:\"\n \"msiexec.exe\" touched \"Q:\"","origin":"API Call","mitre_attack_id":"T1120","relevance":7,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateSystemShutdownW\" (Indicator: \"InitiateSystemShutdown\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; File: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"InitiateSystemShutdownW\" (Indicator: \"InitiateSystemShutdown\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; Source: \"00000000-00004488.00000000.293782.FF0D1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"MSI385F.tmp has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"msiexec.exe\" at 00000000-00002520-00000033-445214\n \"msiexec.exe\" at 00000000-00004488-00000033-124307\n \"MsiExec.exe\" at 00000000-00004200-00000033-122596","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to access VSS COM Interface object","description":"\"CLSID\\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\" is a hint for the \"CLSID of VSS coordinator\" in Source: 00000000-00004488.00000001.295707.01670000.00000004.mdmp\n 00000000-00004488.00000002.297628.01670000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":3,"id":"string-728","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/27 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops non-PE file with executable file extension","description":"\"todop.exe has unusual extension of non executable file\"","origin":"Binary File","mitre_attack_id":"T1036.008","relevance":3,"id":"binary-88","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]}],"intel_graph":{"map":{"Domain:2ef5a454235c706c377cb5d579571003eaf856f85c51073da85a8a9171298561":{"type":"Domain","value":"6bnyi4.oss-cn-beijing.aliyuncs.com","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"File:0a41d8e639848d993967c9a971195eb2a3a46ed15e7ef1f56299cd6e64db6c71":{"type":"File","value":"0a41d8e639848d993967c9a971195eb2a3a46ed15e7ef1f56299cd6e64db6c71"},"File:35773c87e53ee6f8b63fa4e476c2bac6055342d405ee5358cf8fc8c4ede248a4":{"type":"File","value":"35773c87e53ee6f8b63fa4e476c2bac6055342d405ee5358cf8fc8c4ede248a4"},"File:9d06e5c24ba4455780fc4b5f05bb22c85fc50ac07cbe92d5dca6ddaf40734287":{"type":"File","value":"9d06e5c24ba4455780fc4b5f05bb22c85fc50ac07cbe92d5dca6ddaf40734287"},"File:c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58":{"type":"File","value":"c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","filetype":"Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: UNITAT Client Dll, Author: UNITAT Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install UNITAT Licensing Dll., Template: Intel;1033, Revision Number: {D607BB7B-A6F8-4D74-AF08-588EB116290F}, Create Time/Date: Fri Aug 14 06:35:48 2026, Last Saved Time/Date: Fri Aug 14 06:35:48 2026, Number of Pages: 500, Number of Words: 2, Name of Creating Application: WiX Toolset (4.0.5.0), Security: 2","filetype_short":"CDF","mime_type":"application/x-msi"}},"chains":[{"id":"1542566565624660202","root":"File:c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","edges":[{"edge_kind":"contacted_domain","from_key":"File:c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","to_key":"Domain:2ef5a454235c706c377cb5d579571003eaf856f85c51073da85a8a9171298561"}],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"sandbox_network","root":"File:c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","edges":[{"edge_kind":"contacted_domain","from_key":"File:c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","to_key":"Domain:2ef5a454235c706c377cb5d579571003eaf856f85c51073da85a8a9171298561"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","edges":[{"edge_kind":"extracted","from_key":"File:c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","to_key":"File:35773c87e53ee6f8b63fa4e476c2bac6055342d405ee5358cf8fc8c4ede248a4"},{"edge_kind":"extracted","from_key":"File:c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","to_key":"File:0a41d8e639848d993967c9a971195eb2a3a46ed15e7ef1f56299cd6e64db6c71"},{"edge_kind":"extracted","from_key":"File:c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58","to_key":"File:9d06e5c24ba4455780fc4b5f05bb22c85fc50ac07cbe92d5dca6ddaf40734287"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":100,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6a7ebfddc4bb1b481c0a3c31","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":37,"malware_family":"Trojan.MSI.Agent","submit_name":"appinst_ins008.msi","analysis_start_time":"2026-08-14T07:12:31+00:00","indicators_count":{"informative":156,"suspicious":7,"malicious":0},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"6bnyi4.oss-cn-beijing.aliyuncs.com","sources":[{"report_type":"qsp","report_id":""}]}],"http_requests":null,"embedded_domains":[{"value":"6bnyi4.oss-cn-beijing.aliyuncs.com","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}],"processes":[{"pid":2520,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\appinst_ins008.msi\"","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00002520","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":4488,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00004488","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":4200,"ppid":4488,"name":"MsiExec.exe","command_line":"-Embedding B238BAFC8546CF4254575F5627155153 E Global\\MSI0000","sha256":"1a899bef4f64d5cdd23911a6ea09f69483e4dba8e76cda38a37dab6fa24406e8","normalized_path":"%WINDIR%\\system32\\MsiExec.exe","parent_uid":"00000000-00004488","uid":"00000000-00004200"}],"all_imported_dlls":["imm32.dll","msctf.dll","sxs.dll","msihnd.dll","es.dll","bcryptprimitives.dll","gdi32.dll","AcGenral.dll","comctl32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-file-l1-2-0.dll","propsys.dll","dsrole.dll","lpk.dll","ole32.dll","shell32.dll","rpcss.dll","RpcRtRemote.dll","mscoreei.dll","comdlg32.dll","ncrypt.dll","kernel32.dll","AcLayers.dll","api-ms-win-crt-runtime-l1-1-0.dll","samcli.dll","devrtl.dll","msvcrt.dll","usp10.dll","VxSSL64.dll","fltLib.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","hid.dll","cryptsp.dll","rpcrt4.dll","shlwapi.dll","ws2_32.dll","api-ms-win-core-synch-l1-2-0.dll","fusion.dll","msxml3r.dll","samlib.dll","KernelBase.dll","api-ms-win-crt-stdio-l1-1-0.dll","vcruntime140_1.dll","api-ms-win-crt-locale-l1-1-0.dll","msimsg.dll","srvcli.dll","RstrtMgr.dll","msasn1.dll","userenv.dll","rsaenh.dll","mscoree.dll","vsstrace.dll","setupapi.dll","devobj.dll","cabinet.dll","sspicli.dll","api-ms-win-crt-convert-l1-1-0.dll","oleaut32.dll","netutils.dll","msxml3.dll","mpr.dll","wkscli.dll","msvcp140.dll","api-ms-win-crt-environment-l1-1-0.dll","atl.dll","advapi32.dll","user32.dll","msi.dll","sfc_os.dll","dwmapi.dll","nsi.dll","ucrtbase.dll","version.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","vcruntime140.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","cryptbase.dll","uxtheme.dll","bcrypt.dll","sfc.dll","clbcatq.dll","cfgmgr32.dll","pid.dll","sechost.dll","profapi.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","netapi32.dll","srclient.dll","vss_ps.dll","eventcls.dll","apphelp.dll","api-ms-win-core-file-l2-1-0.dll","ntdll.dll","clr.dll","spp.dll","vssapi.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"todop.exe","sha256":"35773c87e53ee6f8b63fa4e476c2bac6055342d405ee5358cf8fc8c4ede248a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"name":"MSI385F.tmp","sha256":"0a41d8e639848d993967c9a971195eb2a3a46ed15e7ef1f56299cd6e64db6c71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"name":"36776ec6.rbs","sha256":"9d06e5c24ba4455780fc4b5f05bb22c85fc50ac07cbe92d5dca6ddaf40734287","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]}],"files_written":[{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\26f3475fc22","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{4368208F-BCAC-11D2-A919-00C04FB98638}","sources":[{"report_type":"sandbox","report_id":"6a7ebfddc4bb1b481c0a3c31"}]}]}},"report_ids":{"sandbox_job_ids":["6a7ebfddc4bb1b481c0a3c31"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.MSI.Agent Sample c7e4e3251b59… — Score 37/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c7e4e3251b59…. Malware family: Trojan.MSI.Agent. Threat score 37/100. 5/24 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.MSI.Agent Sample c7e4e3251b59… — Score 37/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c7e4e3251b59…. Malware family: Trojan.MSI.Agent. Threat score 37/100. 5/24 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c7e4e3251b59e69c520e0a727ec8ece8b9414a35d6cf2d076b0a127fd479fc58"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.MSI.Agent Sample c7e4e3251b59… — Score 37/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c7e4e3251b59…. Malware family: Trojan.MSI.Agent. Threat score 37/100. 5/24 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L45","11",{}]]