24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 80:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4f4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100 Sample dcb2cfd87af6… — Score 81/100 — Hybrid Analysis","description":"Malicious verdict for sample dcb2cfd87af6…. Malware family: Win/malicious_confidence_100. Threat score 81/100. 10/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","keywords":["Malicious","Win/malicious_confidence_100","malware analysis","sandbox report","threat intelligence","dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a"],"about":{"@type":"SoftwareApplication","name":"dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","applicationCategory":["compressed","innosetup"],"identifier":"dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","additionalType":"Malicious sample"},"threatScore":81,"malwareFamily":"Win/malicious_confidence_100","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tcdc,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "is-MGSS8.tmp") file/memory contains long string with (Indicator: "VirtualFree"; File: "is-MGSS8.tmp") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "is-5B1CE.tmp") file/memory contains long string with (Indicator: "VirtualFree"; File: "is-5B1CE.tmp") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "is-JL83O.tmp") file/memory contains long string with (Indicator: "VirtualFree"; File: "is-JL83O.tmp") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "SamFreeMemory" (Indicator: "FreeMemory"; File: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "LsaFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "SamFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "DsRoleFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")26:T123b,Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.00401000.00000020.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")27:Ta83,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")28:T755,Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "CallWindowProcW" (Indicator: "CallWindowProc"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002948.00000000.140823.02CA0000.00000004.mdmp, 00000000-00002948.00000001.141792.02CA0000.00000004.mdmp") Found reference to API "CallWindowProcW" (Indicator: "CallWindowProc"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00005056.00000000.140882.02E80000.00000004.mdmp, 00000000-00005056.00000001.141788.02E80000.00000004.mdmp")29:T44b,"crtgame.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\DLLNXOPTIONS") "crtgame.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "crtgame.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS") "crtgame.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY") "crtgame.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY") "crtgame.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA") "crtgame.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA") "crtgame.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION") "crtgame.exe" (Access type: "OPEN"; Path: "HKLM") "crtgame.exe" (Access type: "QUERY"; Path: "HKLM") "crtgame.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "crtgame.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE")2a:Tacc,"1801923906b6afe1dd3f32480f4e29f8.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-1189202909 [PID: 2948] "1801923906b6afe1dd3f32480f4e29f8.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-1189211926 [PID: 2948] "1801923906b6afe1dd3f32480f4e29f8.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-1189387857 [PID: 2948] "1801923906b6afe1dd3f32480f4e29f8.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-1189395462 [PID: 2948] "1801923906b6afe1dd3f32480f4e29f8.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-1189549603 [PID: 2948] "1801923906b6afe1dd3f32480f4e29f8.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-1189558127 [PID: 2948] "1801923906b6afe1dd3f32480f4e29f8.tmp" queried SystemProcessInformation at 00000000-00005056-00000C15-1190192277 [PID: 5056] "1801923906b6afe1dd3f32480f4e29f8.tmp" queried SystemProcessInformation at 00000000-00005056-00000C15-1190202445 [PID: 5056] "1801923906b6afe1dd3f32480f4e29f8.tmp" queried SystemProcessInformation at 00000000-00005056-00000C15-1191182156 [PID: 5056] "1801923906b6afe1dd3f32480f4e29f8.tmp" queried SystemProcessInformation at 00000000-00005056-00000C15-1191190831 [PID: 5056] "crtgame.exe" queried SystemProcessInformation at 00000000-00002448-00000C15-1193487725 [PID: 2448] "crtgame.exe" queried SystemProcessInformation at 00000000-00002448-00000C15-1193505474 [PID: 2448] "crtgame.exe" queried SystemProcessInformation at 00000000-00002448-00000C15-1193671119 [PID: 2448] "crtgame.exe" queried SystemProcessInformation at 00000000-00002448-00000C15-1193680762 [PID: 2448] "crtgame.exe" queried SystemProcessInformation at 00000000-00002448-00000C15-1193896564 [PID: 2448] "crtgame.exe" queried SystemProcessInformation at 00000000-00002448-00000C15-1193904961 [PID: 2448] "crtgame.exe" queried SystemProcessInformation at 00000000-00002180-00000C15-1201323553 [PID: 2180] "crtgame.exe" queried SystemProcessInformation at 00000000-00002180-00000C15-1201346039 [PID: 2180] "crtgame.exe" queried SystemProcessInformation at 00000000-00002180-00000C15-1201631363 [PID: 2180] "crtgame.exe" queried SystemProcessInformation at 00000000-00002180-00000C15-1201640416 [PID: 2180] "crtgame.exe" queried SystemProcessInformation at 00000000-00002180-00000C15-1201947088 [PID: 2180] "crtgame.exe" queried SystemProcessInformation at 00000000-00002180-00000C15-1201956700 [PID: 2180] "net1.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-1201594124 [PID: 7632] "net1.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-1201604865 [PID: 7632] "net1.exe" queried SystemProcessInformation at 00000000-00007632-00000C15-1201902645 [PID: 7632]2b:T108d,"1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\uninstall\is-1SS2O.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\uninstall\unins000.exe" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\stuff\is-698Q8.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\stuff\date.txt" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\stuff\is-17E9U.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\stuff\tagsreplace.txt" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\stuff\is-51ERJ.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\stuff\date.txt" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\stuff\is-5UJ45.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\stuff\tagsreplace.txt" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-5FO09.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\tak_deco_lib.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-US632.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\avutil-58.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-OA108.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\avfilter-9.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-JKLUF.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\swresample-4.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-7PEIO.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\bass.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-741AF.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\bass_aac.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-MGSS8.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassalac.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-EC3TD.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassape.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-5B1CE.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassdsd.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-E905S.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\basscd.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-75RCA.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassflac.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-T8HGN.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassmix.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-1UES2.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassopus.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-0JIV2.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\basswma.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-TL616.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\basswv.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-7G6C6.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\bass_fx.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-OUL4D.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassmidi.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-JL83O.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\bass_tta.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-TRSVM.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\COPYING.LGPLv2.1" "1801923906b6afe1dd3f32480f4e29f8.tmp" renamed original file"C:\Program Files (x86)\CRTGame\bin\x86\is-HGR7I.tmp" to "%PROGRAMFILES%\(x86)\CRTGame\bin\x86\ff_helper.dll"2c:T93b,Found reference to API GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00002948-43388-212-00407024 Found reference to API Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002948-43388-250-004090A4 Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00002948-43388-291-0040457C Found reference to API MonitorFromWindow@USER32.DLL at 00000000-00005056-44279-127-0042EFFC Found reference to API MonitorFromRect@USER32.DLL at 00000000-00005056-44279-239-0049378C Found reference to API ShutdownBlockReasonDestroy@USER32.DLL at 00000000-00005056-44279-480-0042E9C8 Found reference to API GetSystemWow64DirectoryA@KERNEL32.DLL at 00000000-00005056-44279-856-0042D8BC Found reference to API ChangeWindowMessageFilterEx@USER32.DLL at 00000000-00005056-44279-1108-0042E890 Found reference to API ChangeWindowMessageFilter@USER32.DLL at 00000000-00005056-44279-1109-0042E820 Found reference to API RegDeleteKeyExA@KERNEL32.DLL at 00000000-00005056-44279-2520-0042DD6C Found reference to API GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005056-44279-2523-0042E340 Found reference to API Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00005056-44279-2791-00452850 Found reference to API GetDiskFreeSpaceExA@KERNEL32.DLL at 00000000-00005056-44279-2820-00455328 Found reference to API GetProcAddress@KERNEL32.DLL at 00000000-00005056-44279-2826-00455F18 Found reference to API MonitorFromWindow@USER32.DLL at 00000000-00005056-44279-2955-00462118 Found reference to API AllowSetForegroundWindow@USER32.DLL at 00000000-00005056-44279-3118-0047663C Found reference to API GetFinalPathNameByHandleA@KERNEL32.DLL at 00000000-00005056-44279-3204-00476E18 Found reference to API ShutdownBlockReasonCreate@USER32.DLL at 00000000-00005056-44279-3254-0042E91C Found reference to API GetNativeSystemInfo@KERNEL32.DLL at 00000000-00005056-44279-3283-00481DF0 Found reference to API Sleep@KERNEL32.DLL at 00000000-00005056-44279-3474-00490C98 Found reference to API DisableProcessWindowsGhosting@USER32.DLL at 00000000-00005056-44279-3536-00496E2C Found reference to API VerSetConditionMask@NTDLL.DLL at 00000000-00005056-44279-3538-004776C8 Found reference to API NotifyWinEvent@USER32.DLL at 00000000-00005056-44279-3545-0044EF98 Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00005056-44279-3560-004063342d:T104e,Assembly shows XOR instruction xor dword ptr [ebx+6Dh] edx in Stream UID: 00000000-00002948-43388-31-00407D3C Assembly shows XOR instruction xor eax EDB88320h in Stream UID: 00000000-00002948-43388-67-0040785C Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00002948-43388-67-0040785C Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00002948-43388-67-0040785C Assembly shows XOR instruction xor byte ptr [ecx] ch in Stream UID: 00000000-00002948-43388-118-0040102C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005056-44279-386-00475188 Assembly shows XOR instruction xor dword ptr [eax] esp in Stream UID: 00000000-00005056-44279-471-0047FD14 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 00000000-00005056-44279-544-00438F34 Assembly shows XOR instruction xor word ptr [esi] ax in Stream UID: 00000000-00005056-44279-544-00438F34 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 00000000-00005056-44279-544-00438F34 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005056-44279-563-00437318 Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00005056-44279-672-00450494 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00005056-44279-672-00450494 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005056-44279-757-00476388 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005056-44279-807-0046F68C Assembly shows XOR instruction xor dword ptr [ebp+63h] eax in Stream UID: 00000000-00005056-44279-1096-0045D2CD Assembly shows XOR instruction xor al byte ptr [ebp+63h] in Stream UID: 00000000-00005056-44279-1096-0045D2CD Assembly shows XOR instruction xor bl byte ptr [edi+62h] in Stream UID: 00000000-00005056-44279-1099-0045CD70 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00005056-44279-1131-0044F5A3 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00005056-44279-2890-0045B984 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005056-44279-2890-0045B984 Assembly shows XOR instruction xor cl 01h in Stream UID: 00000000-00005056-44279-3490-004919A0 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00005056-44279-3727-004143F0 Assembly shows XOR instruction xor esi 02h in Stream UID: 00000000-00005056-44279-4574-004803D8 Assembly shows XOR instruction xor eax C3FFFA87h in Stream UID: 00000000-00005056-44279-5281-0045D383 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00005056-44279-6627-0044E704 Assembly shows XOR instruction xor al B2h in Stream UID: 00000000-00002180-49557-1026-006171E1 Assembly shows XOR instruction xor bh dl in Stream UID: 00000000-00002180-49557-1026-006171E1 Assembly shows XOR instruction xor dword ptr [ecx-01497AADh] edx in Stream UID: 00000000-00002180-49557-1026-006171E1 Assembly shows XOR instruction xor eax dword ptr [ecx+00h] in Stream UID: 00000000-00002180-49557-1026-006171E1 Assembly shows XOR instruction xor dl byte ptr [esi+00h] in Stream UID: 00000000-00002180-49557-1026-006171E1 Assembly shows XOR instruction xor esi 88BF4EEDh in Stream UID: 00000000-00002180-49557-1026-006171E1 Assembly shows XOR instruction xor ecx dword ptr [edx] in Stream UID: 00000000-00002180-49557-1026-006171E1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007632-50609-26-00E03240 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007632-50609-30-00E05460 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007632-50609-30-00E05460 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007632-50609-31-00E170DE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007632-50609-33-00E067A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007632-50609-33-00E067A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007632-50609-36-00E04C64 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007632-50609-36-00E04C642e:T8446,Found XOR loop in file "crtgame.exe" at offset 82121; code bytes = 30d0 Found XOR loop in file "crtgame.exe" at offset 93864; code bytes = 30d0 Found XOR loop in file "crtgame.exe" at offset 180304; code bytes = 30d0 Found XOR loop in file "crtgame.exe" at offset 276099; code bytes = 30d0 Found XOR loop in file "crtgame.exe" at offset 297348; code bytes = 30d0 Found XOR loop in file "crtgame.exe" at offset 363618; code bytes = 30d0 Found XOR loop in file "crtgame.exe" at offset 495339; code bytes = 30d0 Found XOR loop in file "crtgame.exe" at offset 572856; code bytes = 30d0 Found XOR loop in file "crtgame.exe" at offset 581690; code bytes = 30d0 Found XOR loop in file "crtgame.exe" at offset 64419; code bytes = 33c1 Found XOR loop in file "crtgame.exe" at offset 197432; code bytes = 33c1 Found XOR loop in file "crtgame.exe" at offset 266311; code bytes = 33c1 Found XOR loop in file "crtgame.exe" at offset 352242; code bytes = 33c1 Found XOR loop in file "crtgame.exe" at offset 575886; code bytes = 33c1 Found XOR loop in file "crtgame.exe" at offset 670653; code bytes = 33c1 Found XOR loop in file "crtgame.exe" at offset 734055; code bytes = 33c1 Found XOR loop in file "crtgame.exe" at offset 774372; code bytes = 33c1 Found XOR loop in file "crtgame.exe" at offset 2068677; code bytes = 33c1 Found XOR loop in file "crtgame.exe" at offset 2153598; code bytes = 33c1 Found XOR loop in file "crtgame.exe" at offset 34461; code bytes = 8030 Found XOR loop in file "crtgame.exe" at offset 55577; code bytes = 8030 Found XOR loop in file "crtgame.exe" at offset 186572; code bytes = 8030 Found XOR loop in file "crtgame.exe" at offset 335534; code bytes = 8030 Found XOR loop in file "crtgame.exe" at offset 575055; code bytes = 8030 Found XOR loop in file "crtgame.exe" at offset 740693; code bytes = 8030 Found XOR loop in file "crtgame.exe" at offset 742898; code bytes = 8030 Found XOR loop in file "crtgame.exe" at offset 769830; code bytes = 8030 Found XOR loop in file "crtgame.exe" at offset 836051; code bytes = 8030 Found XOR loop in file "crtgame.exe" at offset 1382594; code bytes = 8030 Found XOR loop in file "crtgame.exe" at offset 2085184; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 311940; code bytes = 30d0 Found XOR loop in file "is-I1F17.tmp" at offset 456709; code bytes = 30d0 Found XOR loop in file "is-I1F17.tmp" at offset 467061; code bytes = 30d0 Found XOR loop in file "is-I1F17.tmp" at offset 502746; code bytes = 30d0 Found XOR loop in file "is-I1F17.tmp" at offset 510762; code bytes = 30d0 Found XOR loop in file "is-I1F17.tmp" at offset 946717; code bytes = 30d0 Found XOR loop in file "is-I1F17.tmp" at offset 954727; code bytes = 30d0 Found XOR loop in file "is-I1F17.tmp" at offset 956575; code bytes = 30d0 Found XOR loop in file "is-I1F17.tmp" at offset 961903; code bytes = 30d0 Found XOR loop in file "is-I1F17.tmp" at offset 962991; code bytes = 30d0 Found XOR loop in file "is-I1F17.tmp" at offset 18821; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 31787; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 221212; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 224946; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 231578; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 231756; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 231780; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 231830; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 458757; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 459205; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 459781; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 460229; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 569029; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 573637; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 577221; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 581829; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 638341; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 641925; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 646533; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 650117; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 698280; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 947239; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 949673; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 956651; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 966711; code bytes = 33c1 Found XOR loop in file "is-I1F17.tmp" at offset 48038; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 317852; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 324476; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 331231; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 341360; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 343069; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 344804; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 398590; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 470986; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 514617; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 686659; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 693155; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 693291; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 710826; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 715196; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 719858; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 778138; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 947348; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 948242; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 951370; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 956568; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 959478; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 961884; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 962416; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 962484; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 962952; code bytes = 8030 Found XOR loop in file "is-I1F17.tmp" at offset 965536; code bytes = 8030 Found XOR loop in file "is-US632.tmp" at offset 574988; code bytes = 30d0 Found XOR loop in file "is-US632.tmp" at offset 819280; code bytes = 30d0 Found XOR loop in file "is-US632.tmp" at offset 897687; code bytes = 30d0 Found XOR loop in file "is-US632.tmp" at offset 900963; code bytes = 30d0 Found XOR loop in file "is-US632.tmp" at offset 902797; code bytes = 30d0 Found XOR loop in file "is-US632.tmp" at offset 903327; code bytes = 30d0 Found XOR loop in file "is-US632.tmp" at offset 903979; code bytes = 30d0 Found XOR loop in file "is-US632.tmp" at offset 906321; code bytes = 30d0 Found XOR loop in file "is-US632.tmp" at offset 44434; code bytes = 33c1 Found XOR loop in file "is-US632.tmp" at offset 895657; code bytes = 33c1 Found XOR loop in file "is-US632.tmp" at offset 897919; code bytes = 33c1 Found XOR loop in file "is-US632.tmp" at offset 606804; code bytes = 8030 Found XOR loop in file "is-US632.tmp" at offset 678736; code bytes = 8030 Found XOR loop in file "is-US632.tmp" at offset 900924; code bytes = 8030 Found XOR loop in file "is-US632.tmp" at offset 902758; code bytes = 8030 Found XOR loop in file "is-US632.tmp" at offset 903308; code bytes = 8030 Found XOR loop in file "is-US632.tmp" at offset 904154; code bytes = 8030 Found XOR loop in file "is-US632.tmp" at offset 904722; code bytes = 8030 Found XOR loop in file "is-US632.tmp" at offset 905178; code bytes = 8030 Found XOR loop in file "is-TH4QT.tmp" at offset 858275; code bytes = 30d0 Found XOR loop in file "is-TH4QT.tmp" at offset 860453; code bytes = 30d0 Found XOR loop in file "is-TH4QT.tmp" at offset 861171; code bytes = 30d0 Found XOR loop in file "is-TH4QT.tmp" at offset 70018; code bytes = 8030 Found XOR loop in file "is-TH4QT.tmp" at offset 237757; code bytes = 8030 Found XOR loop in file "is-TH4QT.tmp" at offset 544453; code bytes = 8030 Found XOR loop in file "is-TH4QT.tmp" at offset 861132; code bytes = 8030 Found XOR loop in file "is-TH4QT.tmp" at offset 862628; code bytes = 8030 Found XOR loop in file "is-TH4QT.tmp" at offset 862946; code bytes = 8030 Found XOR loop in file "is-TH4QT.tmp" at offset 863164; code bytes = 8030 Found XOR loop in file "is-TH4QT.tmp" at offset 864294; code bytes = 8030 Found XOR loop in file "is-TH4QT.tmp" at offset 865474; code bytes = 8030 Found XOR loop in file "is-BDUOT.tmp" at offset 548368; code bytes = 30d0 Found XOR loop in file "is-BDUOT.tmp" at offset 652775; code bytes = 30d0 Found XOR loop in file "is-BDUOT.tmp" at offset 656201; code bytes = 30d0 Found XOR loop in file "is-BDUOT.tmp" at offset 660503; code bytes = 30d0 Found XOR loop in file "is-BDUOT.tmp" at offset 660741; code bytes = 30d0 Found XOR loop in file "is-BDUOT.tmp" at offset 663543; code bytes = 30d0 Found XOR loop in file "is-BDUOT.tmp" at offset 655649; code bytes = 33c1 Found XOR loop in file "is-BDUOT.tmp" at offset 294137; code bytes = 8030 Found XOR loop in file "is-BDUOT.tmp" at offset 422773; code bytes = 8030 Found XOR loop in file "is-BDUOT.tmp" at offset 653878; code bytes = 8030 Found XOR loop in file "is-BDUOT.tmp" at offset 657294; code bytes = 8030 Found XOR loop in file "is-BDUOT.tmp" at offset 660478; code bytes = 8030 Found XOR loop in file "is-BDUOT.tmp" at offset 660722; code bytes = 8030 Found XOR loop in file "is-BDUOT.tmp" at offset 662872; code bytes = 8030 Found XOR loop in file "is-2GT0F.tmp" at offset 14153; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 89217; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 496310; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 798259; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 808207; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 815455; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 820063; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 821419; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 823141; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 834413; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 843005; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 843659; code bytes = 30d0 Found XOR loop in file "is-2GT0F.tmp" at offset 343747; code bytes = 33c1 Found XOR loop in file "is-2GT0F.tmp" at offset 344557; code bytes = 33c1 Found XOR loop in file "is-2GT0F.tmp" at offset 806755; code bytes = 33c1 Found XOR loop in file "is-2GT0F.tmp" at offset 813939; code bytes = 33c1 Found XOR loop in file "is-2GT0F.tmp" at offset 58733; code bytes = 8030 Found XOR loop in file "is-2GT0F.tmp" at offset 343839; code bytes = 8030 Found XOR loop in file "is-2GT0F.tmp" at offset 625852; code bytes = 8030 Found XOR loop in file "is-2GT0F.tmp" at offset 638202; code bytes = 8030 Found XOR loop in file "is-2GT0F.tmp" at offset 802616; code bytes = 8030 Found XOR loop in file "is-2GT0F.tmp" at offset 806556; code bytes = 8030 Found XOR loop in file "is-2GT0F.tmp" at offset 834398; code bytes = 8030 Found XOR loop in file "is-2GT0F.tmp" at offset 834574; code bytes = 8030 Found XOR loop in file "is-2GT0F.tmp" at offset 840420; code bytes = 8030 Found XOR loop in file "is-2GT0F.tmp" at offset 845000; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 443111; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 508680; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 508972; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 693823; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 695319; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 695833; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 695959; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 712237; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 714415; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 716603; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 718913; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 719475; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 720277; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 722693; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 723821; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 726097; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 727061; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 729399; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 735645; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 737925; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 739069; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 740175; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 741263; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 745651; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 752297; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 754667; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 756723; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 758739; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 761263; code bytes = 30d0 Found XOR loop in file "is-O6COR.tmp" at offset 155230; code bytes = 33c1 Found XOR loop in file "is-O6COR.tmp" at offset 700957; code bytes = 33c1 Found XOR loop in file "is-O6COR.tmp" at offset 715663; code bytes = 33c1 Found XOR loop in file "is-O6COR.tmp" at offset 732891; code bytes = 33c1 Found XOR loop in file "is-O6COR.tmp" at offset 748697; code bytes = 33c1 Found XOR loop in file "is-O6COR.tmp" at offset 751367; code bytes = 33c1 Found XOR loop in file "is-O6COR.tmp" at offset 130384; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 130411; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 130821; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 130848; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 131087; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 131111; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 131336; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 131417; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 131440; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 131464; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 131492; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 131516; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 614557; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 693266; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 699382; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 706974; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 707718; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 711154; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 712202; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 723794; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 725440; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 728698; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 735616; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 741834; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 743932; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 747352; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 748542; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 752284; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 754628; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 756684; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 758700; code bytes = 8030 Found XOR loop in file "is-O6COR.tmp" at offset 761224; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 317464; code bytes = 30d0 Found XOR loop in file "is-1SS2O.tmp" at offset 122873; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 131787; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 134486; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 134568; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 138750; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 138876; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 139333; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 151725; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 153675; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 162622; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 373147; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 396377; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 418241; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 418260; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 418279; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 418304; code bytes = 8030 Found XOR loop in file "is-1SS2O.tmp" at offset 540761; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 317464; code bytes = 30d0 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 122873; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 131787; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 134486; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 134568; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 138750; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 138876; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 139333; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 151725; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 153675; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 162622; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 373147; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 396377; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 418241; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 418260; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 418279; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 418304; code bytes = 8030 Found XOR loop in file "1801923906b6afe1dd3f32480f4e29f8.tmp" at offset 540761; code bytes = 8030 Found XOR loop in file "is-RCUG2.tmp" at offset 498458; code bytes = 30d0 Found XOR loop in file "is-RCUG2.tmp" at offset 498618; code bytes = 30d0 Found XOR loop in file "is-RCUG2.tmp" at offset 614440; code bytes = 30d0 Found XOR loop in file "is-RCUG2.tmp" at offset 624555; code bytes = 30d0 Found XOR loop in file "is-RCUG2.tmp" at offset 625017; code bytes = 30d0 Found XOR loop in file "is-RCUG2.tmp" at offset 633649; code bytes = 30d0 Found XOR loop in file "is-RCUG2.tmp" at offset 634967; code bytes = 30d0 Found XOR loop in file "is-RCUG2.tmp" at offset 635263; code bytes = 30d0 Found XOR loop in file "is-RCUG2.tmp" at offset 636277; code bytes = 30d0 Found XOR loop in file "is-RCUG2.tmp" at offset 621965; code bytes = 33c1 Found XOR loop in file "is-RCUG2.tmp" at offset 625229; code bytes = 33c1 Found XOR loop in file "is-RCUG2.tmp" at offset 273056; code bytes = 8030 Found XOR loop in file "is-RCUG2.tmp" at offset 321283; code bytes = 8030 Found XOR loop in file "is-RCUG2.tmp" at offset 427436; code bytes = 8030 Found XOR loop in file "is-RCUG2.tmp" at offset 508030; code bytes = 8030 Found XOR loop in file "is-RCUG2.tmp" at offset 629808; code bytes = 8030 Found XOR loop in file "is-RCUG2.tmp" at offset 636028; code bytes = 8030 Found XOR loop in file "is-RCUG2.tmp" at offset 636238; code bytes = 8030 Found XOR loop in file "is-RCUG2.tmp" at offset 641008; code bytes = 8030 Found XOR loop in file "is-RCUG2.tmp" at offset 643447; code bytes = 8030 Found XOR loop in file "is-RCUG2.tmp" at offset 643694; code bytes = 8030 Found XOR loop in file "is-2DNUI.tmp" at offset 560637; code bytes = 30d0 Found XOR loop in file "is-2DNUI.tmp" at offset 561525; code bytes = 30d0 Found XOR loop in file "is-2DNUI.tmp" at offset 349717; code bytes = 33c1 Found XOR loop in file "is-2DNUI.tmp" at offset 557753; code bytes = 33c1 Found XOR loop in file "is-2DNUI.tmp" at offset 122946; code bytes = 8030 Found XOR loop in file "is-2DNUI.tmp" at offset 233810; code bytes = 8030 Found XOR loop in file "is-2DNUI.tmp" at offset 271391; code bytes = 8030 Found XOR loop in file "is-2DNUI.tmp" at offset 462426; code bytes = 8030 Found XOR loop in file "is-2DNUI.tmp" at offset 560628; code bytes = 8030 Found XOR loop in file "is-B3Q5N.tmp" at offset 424392; code bytes = 30d0 Found XOR loop in file "is-B3Q5N.tmp" at offset 510951; code bytes = 30d0 Found XOR loop in file "is-B3Q5N.tmp" at offset 2284; code bytes = 33c1 Found XOR loop in file "is-B3Q5N.tmp" at offset 278787; code bytes = 8030 Found XOR loop in file "is-B3Q5N.tmp" at offset 341623; code bytes = 8030 Found XOR loop in file "is-B3Q5N.tmp" at offset 510010; code bytes = 8030 Found XOR loop in file "is-B8KI1.tmp" at offset 18497; code bytes = 30d0 Found XOR loop in file "is-B8KI1.tmp" at offset 91179; code bytes = 33c1 Found XOR loop in file "is-B8KI1.tmp" at offset 91211; code bytes = 33c1 Found XOR loop in file "is-B8KI1.tmp" at offset 110325; code bytes = 33c1 Found XOR loop in file "is-B8KI1.tmp" at offset 258263; code bytes = 33c1 Found XOR loop in file "is-B8KI1.tmp" at offset 270729; code bytes = 33c1 Found XOR loop in file "is-B8KI1.tmp" at offset 270734; code bytes = 33c1 Found XOR loop in file "is-B8KI1.tmp" at offset 278513; code bytes = 33c1 Found XOR loop in file "is-B8KI1.tmp" at offset 346296; code bytes = 33c1 Found XOR loop in file "is-B8KI1.tmp" at offset 350373; code bytes = 33c1 Found XOR loop in file "is-B8KI1.tmp" at offset 369501; code bytes = 33c1 Found XOR loop in file "is-B8KI1.tmp" at offset 8953; code bytes = 8030 Found XOR loop in file "is-B8KI1.tmp" at offset 9000; code bytes = 8030 Found XOR loop in file "is-B8KI1.tmp" at offset 140230; code bytes = 8030 Found XOR loop in file "is-B8KI1.tmp" at offset 226442; code bytes = 8030 Found XOR loop in file "is-B8KI1.tmp" at offset 351000; code bytes = 8030 Found XOR loop in file "is-B8KI1.tmp" at offset 370128; code bytes = 8030 Found XOR loop in file "is-FVU8F.tmp" at offset 322785; code bytes = 30d0 Found XOR loop in file "is-FVU8F.tmp" at offset 334079; code bytes = 30d0 Found XOR loop in file "is-FVU8F.tmp" at offset 245202; code bytes = 33c1 Found XOR loop in file "is-FVU8F.tmp" at offset 245235; code bytes = 33c1 Found XOR loop in file "is-FVU8F.tmp" at offset 245268; code bytes = 33c1 Found XOR loop in file "is-FVU8F.tmp" at offset 245301; code bytes = 33c1 Found XOR loop in file "is-FVU8F.tmp" at offset 323559; code bytes = 33c1 Found XOR loop in file "is-FVU8F.tmp" at offset 328163; code bytes = 33c1 Found XOR loop in file "is-FVU8F.tmp" at offset 54797; code bytes = 8030 Found XOR loop in file "is-FVU8F.tmp" at offset 327676; code bytes = 8030 Found XOR loop in file "is-FVU8F.tmp" at offset 329498; code bytes = 8030 Found XOR loop in file "is-FVU8F.tmp" at offset 330154; code bytes = 8030 Found XOR loop in file "is-FVU8F.tmp" at offset 334072; code bytes = 8030 Found XOR loop in file "is-FVU8F.tmp" at offset 334734; code bytes = 8030 Found XOR loop in file "is-JKLUF.tmp" at offset 67297; code bytes = 30d0 Found XOR loop in file "is-JKLUF.tmp" at offset 67311; code bytes = 30d0 Found XOR loop in file "is-JKLUF.tmp" at offset 68249; code bytes = 30d0 Found XOR loop in file "is-JKLUF.tmp" at offset 68437; code bytes = 30d0 Found XOR loop in file "is-JKLUF.tmp" at offset 68471; code bytes = 30d0 Found XOR loop in file "is-JKLUF.tmp" at offset 68537; code bytes = 30d0 Found XOR loop in file "is-JKLUF.tmp" at offset 68725; code bytes = 30d0 Found XOR loop in file "is-JKLUF.tmp" at offset 68759; code bytes = 30d0 Found XOR loop in file "is-JKLUF.tmp" at offset 314215; code bytes = 30d0 Found XOR loop in file "is-JKLUF.tmp" at offset 314383; code bytes = 30d0 Found XOR loop in file "is-JKLUF.tmp" at offset 314651; code bytes = 30d0 Found XOR loop in file "is-JKLUF.tmp" at offset 312003; code bytes = 33c1 Found XOR loop in file "is-JKLUF.tmp" at offset 73715; code bytes = 8030 Found XOR loop in file "is-JKLUF.tmp" at offset 74185; code bytes = 8030 Found XOR loop in file "is-JKLUF.tmp" at offset 111544; code bytes = 8030 Found XOR loop in file "is-JKLUF.tmp" at offset 112030; code bytes = 8030 Found XOR loop in file "is-JKLUF.tmp" at offset 112824; code bytes = 8030 Found XOR loop in file "is-JKLUF.tmp" at offset 310568; code bytes = 8030 Found XOR loop in file "is-1782F.tmp" at offset 291273; code bytes = 30d0 Found XOR loop in file "is-1782F.tmp" at offset 291345; code bytes = 30d0 Found XOR loop in file "is-1782F.tmp" at offset 293895; code bytes = 30d0 Found XOR loop in file "is-1782F.tmp" at offset 240148; code bytes = 33c1 Found XOR loop in file "is-1782F.tmp" at offset 289017; code bytes = 33c1 Found XOR loop in file "is-1782F.tmp" at offset 121264; code bytes = 30040e Found XOR loop in file "is-1782F.tmp" at offset 290858; code bytes = 8030 Found XOR loop in file "is-1782F.tmp" at offset 293856; code bytes = 8030 Found XOR loop in file "is-OA108.tmp" at offset 251112; code bytes = 30d0 Found XOR loop in file "is-OA108.tmp" at offset 264351; code bytes = 30d0 Found XOR loop in file "is-OA108.tmp" at offset 265345; code bytes = 30d0 Found XOR loop in file "is-OA108.tmp" at offset 93598; code bytes = 8030 Found XOR loop in file "is-OA108.tmp" at offset 262402; code bytes = 8030 Found XOR loop in file "is-OA108.tmp" at offset 265186; code bytes = 8030 Found XOR loop in file "is-99HP5.tmp" at offset 105560; code bytes = 30d0 Found XOR loop in file "is-99HP5.tmp" at offset 1964; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 95690; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 95731; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 96942; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 96968; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 97038; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 97072; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 97250; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 97262; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 97288; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 97303; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 99344; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 103798; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 119274; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 133189; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 133297; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 133443; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 133554; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 133975; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 133991; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 134008; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 134271; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 134287; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 134304; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 134878; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 134990; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 141299; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 141469; code bytes = 33c1 Found XOR loop in file "is-99HP5.tmp" at offset 200132; code bytes = 8030 Found XOR loop in file "is-E9RN0.tmp" at offset 239699; code bytes = 30d0 Found XOR loop in file "is-E9RN0.tmp" at offset 239211; code bytes = 33c1 Found XOR loop in file "is-E9RN0.tmp" at offset 167980; code bytes = 8030 Found XOR loop in file "is-E9RN0.tmp" at offset 177361; code bytes = 8030 Found XOR loop in file "is-E9RN0.tmp" at offset 182485; code bytes = 8030 Found XOR loop in file "is-E9RN0.tmp" at offset 198981; code bytes = 8030 Found XOR loop in file "is-E9RN0.tmp" at offset 202393; code bytes = 8030 Found XOR loop in file "is-6GFSE.tmp" at offset 209584; code bytes = 30d0 Found XOR loop in file "is-6GFSE.tmp" at offset 226315; code bytes = 30d0 Found XOR loop in file "is-6GFSE.tmp" at offset 80008; code bytes = 8030 Found XOR loop in file "is-6GFSE.tmp" at offset 80494; code bytes = 8030 Found XOR loop in file "is-6GFSE.tmp" at offset 81288; code bytes = 8030 Found XOR loop in file "is-6GFSE.tmp" at offset 226540; code bytes = 8030 Found XOR loop in file "is-CLTQM.tmp" at offset 106706; code bytes = 30d0 Found XOR loop in file "is-CLTQM.tmp" at offset 209649; code bytes = 30d0 Found XOR loop in file "is-CLTQM.tmp" at offset 209935; code bytes = 30d0 Found XOR loop in file "is-CLTQM.tmp" at offset 83137; code bytes = 33c1 Found XOR loop in file "is-CLTQM.tmp" at offset 83756; code bytes = 33c1 Found XOR loop in file "is-CLTQM.tmp" at offset 206203; code bytes = 33c1 Found XOR loop in file "is-CLTQM.tmp" at offset 58946; code bytes = 8030 Found XOR loop in file "is-CLTQM.tmp" at offset 161644; code bytes = 8030 Found XOR loop in file "is-CLTQM.tmp" at offset 173994; code bytes = 8030 Found XOR loop in file "is-CLTQM.tmp" at offset 196186; code bytes = 8030 Found XOR loop in file "is-CLTQM.tmp" at offset 205064; code bytes = 8030 Found XOR loop in file "is-CLTQM.tmp" at offset 207020; code bytes = 8030 Found XOR loop in file "is-CLTQM.tmp" at offset 209642; code bytes = 8030 Found XOR loop in file "is-CLTQM.tmp" at offset 209908; code bytes = 8030 Found XOR loop in file "is-ACO5V.tmp" at offset 192313; code bytes = 30d0 Found XOR loop in file "is-ACO5V.tmp" at offset 195337; code bytes = 30d0 Found XOR loop in file "is-ACO5V.tmp" at offset 195298; code bytes = 8030 Found XOR loop in file "is-5FSBO.tmp" at offset 47704; code bytes = 33c1 Found XOR loop in file "is-5FSBO.tmp" at offset 54519; code bytes = 33c1 Found XOR loop in file "is-5FSBO.tmp" at offset 193833; code bytes = 33c1 Found XOR loop in file "is-5FSBO.tmp" at offset 159147; code bytes = 8030 Found XOR loop in file "is-5FSBO.tmp" at offset 160347; code bytes = 8030 Found XOR loop in file "is-5FSBO.tmp" at offset 165884; code bytes = 8030 Found XOR loop in file "is-5FSBO.tmp" at offset 178234; code bytes = 8030 Found XOR loop in file "is-5FSBO.tmp" at offset 192856; code bytes = 8030 Found XOR loop in file "is-741AF.tmp" at offset 18774; code bytes = 33c1 Found XOR loop in file "is-741AF.tmp" at offset 52434; code bytes = 33c1 Found XOR loop in file "is-741AF.tmp" at offset 70377; code bytes = 33c1 Found XOR loop in file "is-741AF.tmp" at offset 90855; code bytes = 33c1 Found XOR loop in file "is-741AF.tmp" at offset 8547; code bytes = 8030 Found XOR loop in file "is-741AF.tmp" at offset 24640; code bytes = 8030 Found XOR loop in file "is-741AF.tmp" at offset 103606; code bytes = 8030 Found XOR loop in file "is-7PEIO.tmp" at offset 2118; code bytes = 30d0 Found XOR loop in file "is-7PEIO.tmp" at offset 108202; code bytes = 30d0 Found XOR loop in file "is-7PEIO.tmp" at offset 3268; code bytes = 33c1 Found XOR loop in file "is-7PEIO.tmp" at offset 41278; code bytes = 8030 Found XOR loop in file "is-7PEIO.tmp" at offset 67395; code bytes = 8030 Found XOR loop in file "is-7PEIO.tmp" at offset 91944; code bytes = 8030 Found XOR loop in file "is-7PEIO.tmp" at offset 119752; code bytes = 80302f:T4cc,Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WNetEnumResourceA" (Indicator: "WNetEnumResourceA"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetLogicalDriveStringsW" (Indicator: "GetLogicalDriveStringsW"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetLogicalDrives" (Indicator: "GetLogicalDrives"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveTypeA"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "WNetEnumResourceA" (Indicator: "WNetEnumResourceA"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveTypeW"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")30:T924,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-99HP5.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-CLTQM.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-5FSBO.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-N4GF7.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-5FO09.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_setup64.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_RegDLL.tmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")31:T5ca,file/memory contains long string with (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "unins000.dat") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\CRTGame_L" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found string "?Software\Microsoft\Windows\CurrentVersion\Uninstall\CRTGame_is1P" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp")32:T472,file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "_setup64.tmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005056-00000C2C-1190620767") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp")33:T61d,Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")34:T481,Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp")35:T829,Found system information discovery API: "GetSystemInfo" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found system information discovery API: "GetEnvironmentStringsW" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found system information discovery API: "GetEnvironmentStrings" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00002180.00000000.141597.004C7000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002180.00000000.141597.004C7000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00002448.00000001.141271.004C7000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002448.00000001.141271.004C7000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00005056.00000001.141788.00401000.00000020.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00005056.00000001.141788.00401000.00000020.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00005056.00000001.141788.004A0000.00000002.mdmp" Found system information discovery API: "ExpandEnvironmentStringsA" in "00000000-00005056.00000001.141788.004A0000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosErrorNoTeb" in "00000000-00005056.00000001.141788.73A91000.00000020.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp"36:T5a1,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002948.00000000.140823.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp")37:Te58,file/memory contains long string with (Indicator: "findwindow"; File: "unins000.dat") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002948.00000000.140823.02CA0000.00000004.mdmp, 00000000-00002948.00000001.141792.02CA0000.00000004.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00002948.00000000.140823.04D00000.00000004.mdmp") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp")38:T1bca,"1801923906b6afe1dd3f32480f4e29f8.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c827514f09800226ecb7600007504000000002d6ecb76b6a30ed92d000000ecb7787598f09800b1ce9800505acb02a0b1ca020100000080000000d8ef98000000aa025cf0980070c8cc765a2247affeffffff2d000000d0cc8775270000002cf09800856acd761c23d2766cf09800f85fcd7608000000bb69cc76b269cc76cea30ed92d000000ecb7787527000000d0cc877540f098002d000000d0cc87752700000070f09800856acd761c23d276b8f098007e8a8675ee8c8675738a8675735d0e6f2d000000ecb7787527000000d0cc8775b411750448117504735d0e6f80f09800fc52c4756cf19800e0848675f35c541afeffffff738a8675 (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005056) "crtgame.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002448) "crtgame.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002448) "crtgame.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002180) "crtgame.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002180)39:Tddc,"1801923906b6afe1dd3f32480f4e29f8.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000002140000cfa9800482140004f214000409c4000409c4000030000008c03cf046c03cf0420000000c522400038fa9800ee224000f5224000409c40000300000024fa98000000000030fa9800b6254000dd314000409c400009040000fb55400003564000409c4000409c40000030780000000000000000000000000050fa9800 (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000021400034f8cf00fc214000032240006c7049006c704900030000008c03ee046c03ee04200000007923400060f8cf00a2234000a92340006c704900030000004cf8cf000000000058f8cf006a264000453440006c704900090400006f894000778940006c7049006c70490000a0b30000000000000000000000000078f8cf00 (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000004e08430000000000f0f7cf0097c0002e0008430000000000d8f7cf0048f8cf008cf8cf0050d42f7584df6ad1feffffff1c2f2d75632b2d7548f8cf000000000098f8cf000b08430048f8cf00576e6450726f635074723030343030303030303030303131384300000070490000004000000901238c11000000a0b300 (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000f023000002000000000000004e08430000000000f0f7cf0097c0002e0008430000000000d8f7cf0048f8cf008cf8cf0050d42f7584df6ad1feffffff1c2f2d75632b2d7548f8cf000000000098f8cf000b08430048f8cf00576e6450726f635074723030343030303030303030303131384300000070490000004000 (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041eced5ae0f7cf0011b9667500004177d4f7cf0000000000 (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetVersionExA" with parameter 9c0000000600000002000000f02300000200000000001000181f480040424477f4f7cf00c4502a7500004177181f48006feb16741cf8cf006feb167400004177181f48006c70490020592a750000417700000000181f48000000000078f8cf006f1e480000004177181f480001000000090000000010000000000100fffffeffff00000008000000d8210000000001000600004f (UID: 00000000-00005056) "crtgame.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000082ba6adee0fb71000000000088fd7100506ac077fea8d3a9fefffffff9debb77a5996875021000000000000000000000001000000000000000000000bc2e4c0098fd7100f9debb77 (UID: 00000000-00002448) "crtgame.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0f60fd3f0fb3d000000000098fd3d00506ac077dce4faa4fefffffff9debb77a5996875021000000000000000000000001000000000000000000000bc2e4c00a8fd3d00f9debb77 (UID: 00000000-00002180)3a:T4fa,GetVersionExA@KERNEL32.DLL at 00000000-00002948-43388-182-00405CE4 GetVersion@KERNEL32.DLL at 00000000-00005056-44279-766-0046D118 GetVersion@KERNEL32.DLL at 00000000-00005056-44279-830-0045C2E0 GetVersionExA@KERNEL32.DLL at 00000000-00005056-44279-2048-00409078 GetVersion@KERNEL32.DLL at 00000000-00005056-44279-2206-00411704 GetVersion@KERNEL32.DLL at 00000000-00005056-44279-2521-0042DFC4 GetVersionExA@KERNEL32.DLL at 00000000-00005056-44279-2682-0044AE58 GetVersion@KERNEL32.DLL at 00000000-00005056-44279-2956-00462400 GetVersion@KERNEL32.DLL at 00000000-00005056-44279-2959-00462558 ISCryptGetVersion@_ISCRYPT.DLL at 00000000-00005056-44279-3244-0045C8A8 GetVersionExA@KERNEL32.DLL at 00000000-00005056-44279-3282-0048211C GetVersion@KERNEL32.DLL at 00000000-00005056-44279-3534-0049706C GetVersionExA@KERNEL32.DLL at 00000000-00005056-44279-3544-0044F440 GetVersionExA@KERNEL32.DLL at 00000000-00005056-44279-3546-0044EF28 GetVersion@KERNEL32.DLL at 00000000-00005056-44279-3551-00419050 GetVersion@KERNEL32.DLL at 00000000-00005056-44279-3554-0041F128 GetVersion@KERNEL32.DLL at 00000000-00005056-44279-4390-004624B8 GetVersion@KERNEL32.DLL at 00000000-00005056-44279-4391-00462308 GetVersion@KERNEL32.DLL at 00000000-00005056-44279-6627-0044E7043b:T564,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")3c:Te30,Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp")3d:T1177,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "!This program cannot be run in DOS mode.RichW.text`.rdata@.relocQSUV^][YD$ EHD$ uDisableThreadLibraryCallsKERNEL32.dllISCrypt.dllArcFourCryptArcFourInitISCryptGetVersion" (Indicator: "GetVersion"; File: "_iscrypt.dll") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetVersionNumbers" (Indicator: "GetVersion"; Source: "00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "ISCryptGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "function GetVersionNumbers(const Filename: String; var VersionMS, VersionLS: Cardinal): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "function GetVersionNumbersString(const Filename: String; var Version: String): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007632.00000000.141611.03310000.00000004.mdmp")3e:T692,Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 0046D15Ch" at 00000000-00005056-44279-766-0046D118 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 0045C315h" at 00000000-00005056-44279-830-0045C2E0 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "jc 00411864h" at 00000000-00005056-44279-2206-00411704 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 0042E041h" at 00000000-00005056-44279-2521-0042DFC4 Found API call GetDiskFreeSpaceA@KERNEL32.DLL directly followed by "cmp byte ptr [ebp-02h], 00h" and "je 0045542Fh" at 00000000-00005056-44279-2820-00455328 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jnc 00462475h" at 00000000-00005056-44279-2956-00462400 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004625CBh" at 00000000-00005056-44279-2959-00462558 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "setnb byte ptr [0049B0C6h]" at 00000000-00005056-44279-3551-00419050 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp bl, 04h" and "jnc 0041F171h" at 00000000-00005056-44279-3554-0041F128 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 00462532h" at 00000000-00005056-44279-4390-004624B8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp dx, 0005h" and "jne 0046238Fh" at 00000000-00005056-44279-4391-00462308 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jne 0044E7AFh" at 00000000-00005056-44279-6627-0044E7043f:T60d,"1801923906b6afe1dd3f32480f4e29f8.exe" called "CreateDirectoryA" with parameter %TEMP%\is-FJQA3.tmp (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "CreateDirectoryA" with parameter %TEMP%\is-SKO5G.tmp (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "CreateDirectoryA" with parameter %TEMP%\is-SKO5G.tmp\_isetup (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CRTGame (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CRTGame\uninstall (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CRTGame\stuff (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86 (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\lessmsi (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\plugins (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "CreateDirectoryA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\plugins\internal (UID: 00000000-00005056)40:T58b,"1801923906b6afe1dd3f32480f4e29f8.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "LoadLibrary" with a parameter %TEMP%\is-SKO5G.tmp\_isetup\_isdecmp.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "LoadLibrary" with a parameter %TEMP%\is-SKO5G.tmp\_isetup\_iscrypt.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00005056) "crtgame.exe" called "LoadLibrary" with a parameter appxsip.dll (UID: 00000000-00002448) "crtgame.exe" called "LoadLibrary" with a parameter appxsip.dll (UID: 00000000-00002180)41:T1394,"1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\uninstall\is-1SS2O.tmp & %PROGRAMFILES%\(x86)\CRTGame\uninstall\unins000.exe (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\stuff\is-698Q8.tmp & %PROGRAMFILES%\(x86)\CRTGame\stuff\date.txt (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\stuff\is-17E9U.tmp & %PROGRAMFILES%\(x86)\CRTGame\stuff\tagsreplace.txt (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\stuff\is-51ERJ.tmp & %PROGRAMFILES%\(x86)\CRTGame\stuff\date.txt (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\stuff\is-5UJ45.tmp & %PROGRAMFILES%\(x86)\CRTGame\stuff\tagsreplace.txt (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-5FO09.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\tak_deco_lib.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-US632.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\avutil-58.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-OA108.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\avfilter-9.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-JKLUF.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\swresample-4.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-7PEIO.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bass.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-741AF.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bass_aac.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-MGSS8.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassalac.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-EC3TD.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassape.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-5B1CE.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassdsd.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-E905S.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\basscd.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-75RCA.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassflac.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-T8HGN.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassmix.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-1UES2.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassopus.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-0JIV2.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\basswma.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-TL616.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\basswv.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-7G6C6.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bass_fx.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-OUL4D.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bassmidi.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-JL83O.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bass_tta.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-TRSVM.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\COPYING.LGPLv2.1 (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "MoveFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-HGR7I.tmp & %PROGRAMFILES%\(x86)\CRTGame\bin\x86\ff_helper.dll (UID: 00000000-00005056)42:T4189,"1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002948) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteA (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompressInit (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompress (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter BZ2_bzDecompressEnd (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter ISCryptGetVersion (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter ArcFourInit (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter ArcFourCrypt (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00005056) "crtgame.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002448) "crtgame.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00002180) "crtgame.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002180) "net1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007632) "net1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007632) "net1.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007632) "net1.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007632) "net1.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007632) "net1.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007632) "net1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007632) "net1.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007632)43:T434,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "CreateProcess failed (%d)." (Indicator: "CreateProcess"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "CreateProcess failed (%d)." (Indicator: "CreateProcess"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp")44:T899,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") file/memory contains long string with (Indicator: "CreateFile"; File: "is-MGSS8.tmp") file/memory contains long string with (Indicator: "CreateFile"; File: "is-5B1CE.tmp") file/memory contains long string with (Indicator: "CreateFile"; File: "is-JL83O.tmp") file/memory contains long string with (Indicator: "CreateFile"; File: "is-176E6.tmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000000.140823.04D00000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.04EF8000.00000004.mdmp, 00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp")45:T62d,Sleep@KERNEL32.DLL at 00000000-00002948-43388-260-004094D8 MsgWaitForMultipleObjects at 00000000-00002948-43388-274-004099A4 MsgWaitForMultipleObjects at 00000000-00002948-43388-279-0040455C WaitForSingleObject@KERNEL32.DLL at 00000000-00005056-44279-112-00458164 Sleep@KERNEL32.DLL at 00000000-00005056-44279-725-0042EC8C MsgWaitForMultipleObjects at 00000000-00005056-44279-835-0045833C MsgWaitForMultipleObjects at 00000000-00005056-44279-836-004060A4 SetTimer at 00000000-00005056-44279-2429-004061AC MsgWaitForMultipleObjects at 00000000-00005056-44279-2807-00454498 Sleep@KERNEL32.DLL at 00000000-00005056-44279-2812-00454B90 MsgWaitForMultipleObjects at 00000000-00005056-44279-2846-004571F0 WaitForSingleObject@KERNEL32.DLL at 00000000-00005056-44279-2848-00457540 Sleep@KERNEL32.DLL at 00000000-00005056-44279-3097-0046A628 MsgWaitForMultipleObjects at 00000000-00005056-44279-3116-00476714 MsgWaitForMultipleObjects at 00000000-00005056-44279-3205-00476FAC Sleep@KERNEL32.DLL at 00000000-00005056-44279-3474-00490C98 WaitForSingleObject@KERNEL32.DLL at 00000000-00005056-44279-3510-00494950 MsgWaitForMultipleObjects at 00000000-00005056-44279-3516-004950AC MsgWaitForMultipleObjects at 00000000-00005056-44279-3523-00495488 MsgWaitForMultipleObjects at 00000000-00005056-44279-3530-00496894 Sleep@KERNEL32.DLL at 00000000-00005056-44279-4529-00474E9B Sleep@KERNEL32.DLL at 00000000-00005056-44279-4553-0047B7B0 Sleep at 00000000-00007632-50609-23-00E06CF0 Sleep at 00000000-00007632-50609-92-00E05710 Sleep at 00000000-00007632-50609-112-00E0ACDA46:T5dc,Found reference to API "ShellExecuteEx failed (%d)." (Indicator: "ShellExecute"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx" (Indicator: "ShellExecute"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx returned hProcess=0" (Indicator: "ShellExecute"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "ShellExecuteEx failed (%d)." (Indicator: "ShellExecute"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx returned hProcess=0" (Indicator: "ShellExecute"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp")47:Taf1,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.00401000.00000020.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp")48:T636,Found reference to API "MoveFileEx" (Indicator: "MoveFile"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "MoveFileEx failed (%d)." (Indicator: "MoveFile"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "MoveFileA" (Indicator: "MoveFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "MoveFileEx" (Indicator: "MoveFile"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "MoveFileEx failed (%d)." (Indicator: "MoveFile"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp")49:T5ee,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")4a:T7bc,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")4b:T15c4,"Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 44279-677-00477940 "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 44279-714-00458B78 "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 44279-714-00458B78 "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 44279-714-00458B78 "SOFTWARE\Microsoft\.NETFramework" in Source: 44279-715-00458A84 "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 44279-788-00471FB4 "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 44279-824-00453A44 "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 44279-2813-00454BF4 "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 44279-3132-0046E080 "Software\Microsoft\Windows\CurrentVersion" in Source: 44279-3219-0047AFDC "System\CurrentControlSet\Control\Windows" in Source: 44279-3278-00481F38 "System\CurrentControlSet\Control\ProductOptions" in Source: 44279-3279-00481FE0 "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 44279-4389-0046232F "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 44279-4519-00473351 "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 50609-44-00E174A7 "Software\Microsoft\Windows NT\CurrentVersion" in Source: 50609-84-00E0A2FE "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005056.00000000.140882.02E80000.00000004.mdmp 00000000-00005056.00000001.141788.02E80000.00000004.mdmp "Software\CRTGame\CRTG12102" in Source: 00000000-00005056.00000000.140882.04EF8000.00000004.mdmp 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\CRTGame_L" in Source: 00000000-00005056.00000000.140882.04F10000.00000004.mdmp 00000000-00005056.00000001.141788.04F10000.00000004.mdmp "?Software\Microsoft\Windows\CurrentVersion\Uninstall\CRTGame_is1P" in Source: 00000000-00005056.00000000.140882.04F10000.00000004.mdmp 00000000-00005056.00000001.141788.04F10000.00000004.mdmp "?Software\Microsoft\Windows\CurrentVersion\Uni" in Source: 00000000-00005056.00000000.140882.04F10000.00000004.mdmp 00000000-00005056.00000001.141788.04F10000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00005056.00000001.141788.004A0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005056.00000001.141788.004A0000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005056.00000001.141788.004A0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00005056.00000001.141788.004A0000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00005056.00000001.141788.73A91000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00005056.00000001.141788.73A91000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00005056.00000001.141788.73A91000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00005056.00000001.141788.73A91000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007632.00000000.141611.00E01000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00007632.00000000.141611.00E01000.00000020.mdmp4c:T68a,Process 1801923906b6afe1dd3f32480f4e29f8.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2948:168:WilStaging_02" Process 1801923906b6afe1dd3f32480f4e29f8.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2948:168:WilStaging_02" Process 1801923906b6afe1dd3f32480f4e29f8.exe created mutex with name "SM0:2948:168:WilStaging_02" Process 1801923906b6afe1dd3f32480f4e29f8.exe created mutex with name "Local\SM0:2948:168:WilStaging_02" Process 1801923906b6afe1dd3f32480f4e29f8.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5056:168:WilStaging_02" Process 1801923906b6afe1dd3f32480f4e29f8.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5056:168:WilStaging_02" Process 1801923906b6afe1dd3f32480f4e29f8.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5056:64:WilError_01" Process 1801923906b6afe1dd3f32480f4e29f8.tmp created mutex with name "Local\SM0:5056:168:WilStaging_02" Process 1801923906b6afe1dd3f32480f4e29f8.tmp created mutex with name "SM0:5056:64:WilError_01" Process 1801923906b6afe1dd3f32480f4e29f8.tmp created mutex with name "SM0:5056:168:WilStaging_02" Process crtgame.exe created mutex with name "\Sessions\1\BaseNamedObjects\AnyMediaPlayer" Process crtgame.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2448:168:WilStaging_02" Process crtgame.exe created mutex with name "SM0:2448:168:WilStaging_02" Process crtgame.exe created mutex with name "AnyMediaPlayer" Process crtgame.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2180:168:WilStaging_02" Process crtgame.exe created mutex with name "SM0:2180:168:WilStaging_02"4d:T8c8,Antivirus vendors marked dropped file "_isdecmp.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "_iscrypt.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections"), Antivirus vendors marked dropped file "is-I1F17.tmp" as clean (type is "PE32 executable for MS Windows 5.01 (DLL) Intel i386 9 sections"), Antivirus vendors marked dropped file "is-US632.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"), Antivirus vendors marked dropped file "is-BDUOT.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 18 sections"), Antivirus vendors marked dropped file "is-2GT0F.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "is-1SS2O.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"), Antivirus vendors marked dropped file "1801923906b6afe1dd3f32480f4e29f8.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"), Antivirus vendors marked dropped file "is-RCUG2.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"), Antivirus vendors marked dropped file "is-B3Q5N.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"), Antivirus vendors marked dropped file "is-B8KI1.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "is-JKLUF.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"), Antivirus vendors marked dropped file "is-OA108.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"), Antivirus vendors marked dropped file "is-99HP5.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"), Antivirus vendors marked dropped file "is-EVVCU.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections")4e:T452,"is-I1F17.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-US632.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-2GT0F.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-O6COR.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-2DNUI.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-B3Q5N.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-B8KI1.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-FVU8F.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-JKLUF.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-OA108.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT4f:T1218,"REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005056.00000000.140882.02E80000.00000004.mdmp "Software\CRTGame\CRTG12102" in Source: 00000000-00005056.00000000.140882.04EF8000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\CRTGame_L" in Source: 00000000-00005056.00000000.140882.04F10000.00000004.mdmp "?Software\Microsoft\Windows\CurrentVersion\Uninstall\CRTGame_is1P" in Source: 00000000-00005056.00000000.140882.04F10000.00000004.mdmp "?Software\Microsoft\Windows\CurrentVersion\Uni" in Source: 00000000-00005056.00000000.140882.04F10000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00005056.00000001.141788.004A0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00005056.00000001.141788.004A0000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005056.00000001.141788.004A0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00005056.00000001.141788.004A0000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005056.00000001.141788.02E80000.00000004.mdmp "Software\CRTGame\CRTG12102" in Source: 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\CRTGame_L" in Source: 00000000-00005056.00000001.141788.04F10000.00000004.mdmp "?Software\Microsoft\Windows\CurrentVersion\Uninstall\CRTGame_is1P" in Source: 00000000-00005056.00000001.141788.04F10000.00000004.mdmp "?Software\Microsoft\Windows\CurrentVersion\Uni" in Source: 00000000-00005056.00000001.141788.04F10000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00005056.00000001.141788.73A91000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00005056.00000001.141788.73A91000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00005056.00000001.141788.73A91000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00005056.00000001.141788.73A91000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007632.00000000.141611.00E01000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00007632.00000000.141611.00E01000.00000020.mdmp50:Te83,"1801923906b6afe1dd3f32480f4e29f8.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74060000 "1801923906b6afe1dd3f32480f4e29f8.exe" loaded module "SHELL32.DLL" at base 75760000 "1801923906b6afe1dd3f32480f4e29f8.exe" loaded module "COMCTL32.DLL" at base 741c0000 "1801923906b6afe1dd3f32480f4e29f8.exe" loaded module "KERNEL32.DLL" at base 75290000 "1801923906b6afe1dd3f32480f4e29f8.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fe0000 "1801923906b6afe1dd3f32480f4e29f8.exe" loaded module "NTDLL.DLL" at base 77b90000 "1801923906b6afe1dd3f32480f4e29f8.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 743e0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74060000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73fe0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "KERNEL32.DLL" at base 75290000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "OLEAUT32.DLL" at base 777b0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "RPCRT4.DLL" at base 751d0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76aa0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76aa0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 770e0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77940000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "UXTHEME.DLL" at base 73fe0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "SHELL32.DLL" at base 75760000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "SHFOLDER.DLL" at base 73b20000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%TEMP%\IS-SKO5G.TMP\_ISETUP\_ISDECMP.DLL" at base 6150000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%TEMP%\IS-SKO5G.TMP\_ISETUP\_ISCRYPT.DLL" at base 10000000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "USER32.DLL" at base 76aa0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "COMCTL32" at base 741c0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "COMCTL32.DLL" at base 741c0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 76c20000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75760000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 73a90000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "NTDLL.DLL" at base 77b90000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "SSPICLI.DLL" at base 75140000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77a90000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 735d0000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 7e70000 "1801923906b6afe1dd3f32480f4e29f8.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 743e0000 "crtgame.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74060000 "crtgame.exe" loaded module "KERNEL32.DLL" at base 75290000 "crtgame.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75290000 "crtgame.exe" loaded module "APPXSIP.DLL" at base 734f0000 "crtgame.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 75290000 "crtgame.exe" loaded module "APPXSIP.DLL" at base 734b0000 "net1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 7406000051:T12d9,"1801923906b6afe1dd3f32480f4e29f8.exe" was detected as "Inno Setup Module" and name: "Installer" "1801923906b6afe1dd3f32480f4e29f8.exe" was detected as "Borland Delphi" and name: "Compiler" "1801923906b6afe1dd3f32480f4e29f8.exe" was detected as "Turbo Linker" and name: "Linker" "crtgame.exe" was detected as "Inno Setup Module" and name: "Installer" "crtgame.exe" was detected as "Borland Delphi" and name: "Compiler" "crtgame.exe" was detected as "Turbo Linker" and name: "Linker" "_isdecmp.dll" was detected as "Inno Setup Module" and name: "Installer" "_isdecmp.dll" was detected as "Borland Delphi" and name: "Compiler" "_isdecmp.dll" was detected as "Turbo Linker" and name: "Linker" "_iscrypt.dll" was detected as "Inno Setup Module" and name: "Installer" "_iscrypt.dll" was detected as "Borland Delphi" and name: "Compiler" "_iscrypt.dll" was detected as "Turbo Linker" and name: "Linker" "is-I1F17.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-I1F17.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-I1F17.tmp" was detected as "Turbo Linker" and name: "Linker" "is-US632.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-US632.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-US632.tmp" was detected as "Turbo Linker" and name: "Linker" "is-TH4QT.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-TH4QT.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-TH4QT.tmp" was detected as "Turbo Linker" and name: "Linker" "is-BDUOT.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-BDUOT.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-BDUOT.tmp" was detected as "Turbo Linker" and name: "Linker" "is-2GT0F.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-2GT0F.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-2GT0F.tmp" was detected as "Turbo Linker" and name: "Linker" "is-O6COR.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-O6COR.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-O6COR.tmp" was detected as "Turbo Linker" and name: "Linker" "is-1SS2O.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-1SS2O.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-1SS2O.tmp" was detected as "Turbo Linker" and name: "Linker" "1801923906b6afe1dd3f32480f4e29f8.tmp" was detected as "Inno Setup Module" and name: "Installer" "1801923906b6afe1dd3f32480f4e29f8.tmp" was detected as "Borland Delphi" and name: "Compiler" "1801923906b6afe1dd3f32480f4e29f8.tmp" was detected as "Turbo Linker" and name: "Linker" "is-RCUG2.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-RCUG2.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-RCUG2.tmp" was detected as "Turbo Linker" and name: "Linker" "is-2DNUI.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-2DNUI.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-2DNUI.tmp" was detected as "Turbo Linker" and name: "Linker" "is-B3Q5N.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-B3Q5N.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-B3Q5N.tmp" was detected as "Turbo Linker" and name: "Linker" "is-B8KI1.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-B8KI1.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-B8KI1.tmp" was detected as "Turbo Linker" and name: "Linker" "is-FVU8F.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-FVU8F.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-FVU8F.tmp" was detected as "Turbo Linker" and name: "Linker" "is-JKLUF.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-JKLUF.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-JKLUF.tmp" was detected as "Turbo Linker" and name: "Linker" "is-1782F.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-1782F.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-1782F.tmp" was detected as "Turbo Linker" and name: "Linker" "is-OA108.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-OA108.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-OA108.tmp" was detected as "Turbo Linker" and name: "Linker" "is-99HP5.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-99HP5.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-99HP5.tmp" was detected as "Turbo Linker" and name: "Linker" "is-E9RN0.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-E9RN0.tmp" was detected as "Borland Delphi" and name: "Compiler" "is-E9RN0.tmp" was detected as "Turbo Linker" and name: "Linker"52:T4d9,"1801923906b6afe1dd3f32480f4e29f8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1801923906b6afe1dd3f32480f4e29f8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1801923906b6afe1dd3f32480f4e29f8.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1801923906b6afe1dd3f32480f4e29f8.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1801923906b6afe1dd3f32480f4e29f8.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1801923906b6afe1dd3f32480f4e29f8.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1801923906b6afe1dd3f32480f4e29f8.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "crtgame.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")53:T70d,"1801923906b6afe1dd3f32480f4e29f8.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "crtgame.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_isdecmp.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_iscrypt.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-I1F17.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-US632.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-TH4QT.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-BDUOT.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-2GT0F.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-O6COR.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-1SS2O.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "1801923906b6afe1dd3f32480f4e29f8.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-RCUG2.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-2DNUI.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-B3Q5N.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-B8KI1.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-FVU8F.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-JKLUF.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-1782F.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-OA108.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-99HP5.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-E9RN0.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE54:T85c,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")55:T32ce,"crtgame.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\crtgame.exe]- [targetUID: 00000000-00002448] "_isdecmp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-SKO5G.tmp\_isetup\_isdecmp.dll]- [targetUID: 00000000-00005056] "_iscrypt.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-SKO5G.tmp\_isetup\_iscrypt.dll]- [targetUID: 00000000-00005056] "is-M8MSM.tmp" has type "data"- Location: [%PROGRAMFILES%\(x86)\CRTGame\is-M8MSM.tmp]- [targetUID: 00000000-00005056] "is-I1F17.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 9 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-I1F17.tmp]- [targetUID: 00000000-00005056] "is-US632.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-US632.tmp]- [targetUID: 00000000-00005056] "is-TH4QT.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-TH4QT.tmp]- [targetUID: 00000000-00005056] "is-BDUOT.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 18 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-BDUOT.tmp]- [targetUID: 00000000-00005056] "is-2GT0F.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-2GT0F.tmp]- [targetUID: 00000000-00005056] "is-O6COR.tmp" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-O6COR.tmp]- [targetUID: 00000000-00005056] "is-1SS2O.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\uninstall\is-1SS2O.tmp]- [targetUID: 00000000-00005056] "1801923906b6afe1dd3f32480f4e29f8.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%TEMP%\is-FJQA3.tmp\1801923906b6afe1dd3f32480f4e29f8.tmp]- [targetUID: 00000000-00002948] "is-RCUG2.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-RCUG2.tmp]- [targetUID: 00000000-00005056] "is-2DNUI.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-2DNUI.tmp]- [targetUID: 00000000-00005056] "is-B3Q5N.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-B3Q5N.tmp]- [targetUID: 00000000-00005056] "is-CKNJD.tmp" has type "Zip archive data made by v4.5 extract using at least v2.0 last modified Jul 01 2019 03:46:56 uncompressed size 8704 method=deflate"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\lessmsi\is-CKNJD.tmp]- [targetUID: 00000000-00005056] "is-B8KI1.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-B8KI1.tmp]- [targetUID: 00000000-00005056] "is-FVU8F.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-FVU8F.tmp]- [targetUID: 00000000-00005056] "is-JKLUF.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-JKLUF.tmp]- [targetUID: 00000000-00005056] "is-1782F.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-1782F.tmp]- [targetUID: 00000000-00005056] "is-OA108.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-OA108.tmp]- [targetUID: 00000000-00005056] "is-99HP5.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-99HP5.tmp]- [targetUID: 00000000-00005056] "is-E9RN0.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-E9RN0.tmp]- [targetUID: 00000000-00005056] "is-6GFSE.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-6GFSE.tmp]- [targetUID: 00000000-00005056] "is-CLTQM.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-CLTQM.tmp]- [targetUID: 00000000-00005056] "is-ACO5V.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-ACO5V.tmp]- [targetUID: 00000000-00005056] "is-5FSBO.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-5FSBO.tmp]- [targetUID: 00000000-00005056] "is-741AF.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-741AF.tmp]- [targetUID: 00000000-00005056] "is-7PEIO.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-7PEIO.tmp]- [targetUID: 00000000-00005056] "is-JL38M.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-JL38M.tmp]- [targetUID: 00000000-00005056] "is-EJ5GB.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 8 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-EJ5GB.tmp]- [targetUID: 00000000-00005056] "is-N4GF7.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-N4GF7.tmp]- [targetUID: 00000000-00005056] "is-5FO09.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-5FO09.tmp]- [targetUID: 00000000-00005056] "is-1UES2.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-1UES2.tmp]- [targetUID: 00000000-00005056] "is-ND5O5.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-ND5O5.tmp]- [targetUID: 00000000-00005056] "is-HGR7I.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-HGR7I.tmp]- [targetUID: 00000000-00005056] "is-16HGU.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-16HGU.tmp]- [targetUID: 00000000-00005056] "is-EC3TD.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-EC3TD.tmp]- [targetUID: 00000000-00005056] "is-75RCA.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-75RCA.tmp]- [targetUID: 00000000-00005056] "is-OUL4D.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-OUL4D.tmp]- [targetUID: 00000000-00005056] "is-TL616.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-TL616.tmp]- [targetUID: 00000000-00005056] "is-7G6C6.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-7G6C6.tmp]- [targetUID: 00000000-00005056] "is-SRUKB.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-SRUKB.tmp]- [targetUID: 00000000-00005056] "is-TRSVM.tmp" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-TRSVM.tmp]- [targetUID: 00000000-00005056] "is-D07S7.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-D07S7.tmp]- [targetUID: 00000000-00005056] "is-9KF1S.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\plugins\internal\is-9KF1S.tmp]- [targetUID: 00000000-00005056] "is-R5S1L.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 8 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-R5S1L.tmp]- [targetUID: 00000000-00005056] "is-T8HGN.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-T8HGN.tmp]- [targetUID: 00000000-00005056] "is-E905S.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-E905S.tmp]- [targetUID: 00000000-00005056] "is-0JIV2.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-0JIV2.tmp]- [targetUID: 00000000-00005056] "is-2FR1F.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-2FR1F.tmp]- [targetUID: 00000000-00005056] "is-7VHIE.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\plugins\internal\is-7VHIE.tmp]- [targetUID: 00000000-00005056] "is-TEH5V.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-TEH5V.tmp]- [targetUID: 00000000-00005056] "is-5V2FQ.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-5V2FQ.tmp]- [targetUID: 00000000-00005056] "is-MGSS8.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-MGSS8.tmp]- [targetUID: 00000000-00005056] "is-5B1CE.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-5B1CE.tmp]- [targetUID: 00000000-00005056] "unins000.dat" has type "InnoSetup Log CRTGame version 0x30 8031 bytes DESKTOP-FVVF82A\HAPUBWS "C:\Program Files (x86)\CRTGame""- Location: [%PROGRAMFILES%\(x86)\CRTGame\uninstall\unins000.dat]- [targetUID: 00000000-00005056] "is-JL83O.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-JL83O.tmp]- [targetUID: 00000000-00005056] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-SKO5G.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00005056] "is-176E6.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-176E6.tmp]- [targetUID: 00000000-00005056] "_RegDLL.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 3 sections"- Location: [%TEMP%\is-SKO5G.tmp\_isetup\_RegDLL.tmp]- [targetUID: 00000000-00005056] "is-5UJ45.tmp" has type "Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CRTGame\stuff\is-5UJ45.tmp]- [targetUID: 00000000-00005056] "is-698Q8.tmp" has type "IFF data"- Location: [%PROGRAMFILES%\(x86)\CRTGame\stuff\is-698Q8.tmp]- [targetUID: 00000000-00005056] "is-ILRE8.tmp" has type "Unicode text UTF-8 text"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-ILRE8.tmp]- [targetUID: 00000000-00005056] "is-EVVCU.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-EVVCU.tmp]- [targetUID: 00000000-00005056] "is-17E9U.tmp" has type "Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\CRTGame\stuff\is-17E9U.tmp]- [targetUID: 00000000-00005056] "is-51ERJ.tmp" has type "IFF data"- Location: [%PROGRAMFILES%\(x86)\CRTGame\stuff\is-51ERJ.tmp]- [targetUID: 00000000-00005056]56:T108c,"is-M8MSM.tmp" has type "data" - Location: [%PROGRAMFILES%\(x86)\CRTGame\is-M8MSM.tmp] "is-I1F17.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 9 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-I1F17.tmp] "is-US632.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-US632.tmp] "is-TH4QT.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-TH4QT.tmp] "is-BDUOT.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 18 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-BDUOT.tmp] "is-2GT0F.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-2GT0F.tmp] "is-O6COR.tmp" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 11 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-O6COR.tmp] "is-1SS2O.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\uninstall\is-1SS2O.tmp] "1801923906b6afe1dd3f32480f4e29f8.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections" - Location: [%TEMP%\is-FJQA3.tmp\1801923906b6afe1dd3f32480f4e29f8.tmp] "is-RCUG2.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-RCUG2.tmp] "is-2DNUI.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-2DNUI.tmp] "is-B3Q5N.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-B3Q5N.tmp] "is-CKNJD.tmp" has type "Zip archive data made by v4.5 extract using at least v2.0 last modified Jul 01 2019 03:46:56 uncompressed size 8704 method=deflate" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\lessmsi\is-CKNJD.tmp] "is-B8KI1.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-B8KI1.tmp] "is-FVU8F.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-FVU8F.tmp] "is-JKLUF.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-JKLUF.tmp] "is-1782F.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-1782F.tmp] "is-OA108.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-OA108.tmp] "is-99HP5.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-99HP5.tmp] "is-E9RN0.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-E9RN0.tmp] "is-6GFSE.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-6GFSE.tmp] "is-CLTQM.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-CLTQM.tmp] "is-ACO5V.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-ACO5V.tmp] "is-5FSBO.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-5FSBO.tmp] "is-741AF.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections" - Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-741AF.tmp]57:T673,"1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")58:T438,"1801923906b6afe1dd3f32480f4e29f8.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\1801923906b6afe1dd3f32480f4e29f8.tmp" (UID: 2948) "1801923906b6afe1dd3f32480f4e29f8.tmp" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\1801923906b6afe1dd3f32480f4e29f8.tmp" (UID: 5056) "1801923906b6afe1dd3f32480f4e29f8.tmp" queries basic process information of the "C:\Windows\SysWOW64\schtasks.exe" (UID: 5056) "1801923906b6afe1dd3f32480f4e29f8.tmp" queries basic process information of the "C:\Program Files (x86)\CRTGame\crtgame.exe" (UID: 5056) "1801923906b6afe1dd3f32480f4e29f8.tmp" queries basic process information of the "C:\Windows\SysWOW64\net.exe" (UID: 5056) "crtgame.exe" queries basic process information of the "C:\Program Files (x86)\CRTGame\crtgame.exe" (UID: 2448) "net.exe" queries basic process information of the "C:\Windows\SysWOW64\net1.exe" (UID: 2268) "crtgame.exe" queries basic process information of the "C:\Program Files (x86)\CRTGame\crtgame.exe" (UID: 2180)59:Tbe7,"1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "1801923906B6AFE1DD3F32480F4E29F8.EXE"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "")5a:T41f,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to query volume size5b:Ta6d,"1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\uninstall\unins000.dat" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\uninstall\is-1SS2O.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\stuff\is-698Q8.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\stuff\is-17E9U.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\stuff\is-51ERJ.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\stuff\is-5UJ45.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-5FO09.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-US632.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-OA108.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-JKLUF.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-7PEIO.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-741AF.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-MGSS8.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-EC3TD.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-5B1CE.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-E905S.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-75RCA.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-T8HGN.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-1UES2.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-0JIV2.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-TL616.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-7G6C6.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-OUL4D.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-JL83O.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" touched file "C:\Program Files (x86)\CRTGame\bin\x86\is-TRSVM.tmp"5c:T985,"1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\MSVCP140.DLL" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\MSVCP140.dll" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\FLTLIB.DLL" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\NETMSG.DLL" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\netmsg.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\MPR.DLL" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\mpr.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\VERSION.DLL" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\version.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\FLTLIB.DLL" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\MSVCP140.DLL" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\MSVCP140.dll" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\VCRUNTIME140.DLL" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\VCRUNTIME140.dll"5d:Ta80,"1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\1801923906B6AFE1DD3F32480F4E29F8.EXE.LOCAL" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\1801923906b6afe1dd3f32480f4e29f8.exe.Local\" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-FJQA3.TMP" "1801923906b6afe1dd3f32480f4e29f8.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\1801923906B6AFE1DD3F32480F4E29F8.TMP.LOCAL" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\1801923906b6afe1dd3f32480f4e29f8.tmp.Local\" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-SKO5G.TMP" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-SKO5G.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Program Files (x86)\CRTGAME" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Program Files (x86)\CRTGame" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Program Files (x86)\CRTGame\UNINSTALL" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Program Files (x86)\CRTGame\uninstall" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\PROGRAM_FILES_X86_CRTGAME_UNINSTALL_054732BEC2C9CCBD.CDF-MS" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "\SystemRoot\WinSxS\FileMaps\program_files_x86_crtgame_uninstall_054732bec2c9ccbd.cdf-ms" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Program Files (x86)\CRTGame\uninstall\IS-1SS2O.TMP" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Program Files (x86)\CRTGame\uninstall\is-1SS2O.tmp" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\PROGRAM_FILES_X86_CRTGAME_STUFF_223AA08A6DA2BC33.CDF-MS" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "\SystemRoot\WinSxS\FileMaps\program_files_x86_crtgame_stuff_223aa08a6da2bc33.cdf-ms" "1801923906b6afe1dd3f32480f4e29f8.tmp" trying to access non-existent file "C:\Program Files (x86)\CRTGame\STUFF"5e:T648,Found reference to API "WNetOpenEnumA" (Indicator: "WNetOpenEnum"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WNetGetUniversalNameA" (Indicator: "WNetGetUniversalName"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WNetEnumResourceA" (Indicator: "WNetEnumResource"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WNetGetConnectionA" (Indicator: "WNetGetConnection"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WNetOpenEnumA" (Indicator: "WNetOpenEnum"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "WNetGetUniversalNameA" (Indicator: "WNetGetUniversalName"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "WNetGetConnectionA" (Indicator: "WNetGetConnection"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "WNetEnumResourceA" (Indicator: "WNetEnumResource"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp")5f:T460,Found reference to API "NetUserModalsGet" (Indicator: "NetUserModalsGet"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "NetUserModalsSet" (Indicator: "NetUserModalsSet"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "NetGroupGetInfo" (Indicator: "NetGroupGetInfo"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "NetGroupSetInfo" (Indicator: "NetGroupSetInfo"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "NetUserSetInfo" (Indicator: "NetUserSetInfo"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "NetUserGetGroups" (Indicator: "NetUserGetGroups"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")60:T675,Pattern match: "http://schemas.microsoft.com/smi/2" Heuristic match: "~5:.jm" Heuristic match: "m\.hu" Heuristic match: "v;.kr" Heuristic match: "" (Indicator: "GetDC"; Source: "00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002948.00000000.140823.02CA0000.00000004.mdmp, 00000000-00002948.00000001.141792.02CA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002948.00000000.140823.02CA0000.00000004.mdmp, 00000000-00002948.00000001.141792.02CA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002948.00000000.140823.02CA0000.00000004.mdmp, 00000000-00002948.00000001.141792.02CA0000.00000004.mdmp")62:Tcac,Found registry query API: "RegOpenKeyExA" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found registry query API: "RegQueryValueExA" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found registry query API: "RegOpenKeyEx" in file "00000000-00005056.00000001.141788.00401000.00000020.mdmp" Found registry query API: "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" in file "00000000-00005056.00000001.141788.00401000.00000020.mdmp" Found registry query API: "NtQueryValueKey" in file "00000000-00002180.00000001.141782.00579000.00000040.mdmp" Found registry query API: "RegOpenKeyW" in file "00000000-00007632.00000000.141611.00E01000.00000020.mdmp" Found registry query API: "RegQueryValueExW" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found registry query API: "RegOpenKeyExW" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found registry query API: "RegEnumKeyExA" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found registry query API: "RegEnumValueA" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found registry query API: "RegQueryInfoKeyA" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found registry query API: "NtQueryValueKey" in "00000000-00002180.00000001.141782.00579000.00000040.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyA" in "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp" Found registry query API: "RegGetValueNames" in "00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp" Found registry query API: "RegGetValueW" in "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp"63:T757,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp")64:Tca4,Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "LookupAccountSidLocalW" (Indicator: "LookupAccountSid"; File: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "LookupAccountNameLocalW" (Indicator: "LookupAccountName"; File: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; File: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; File: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "LsaLookupNames" (Indicator: "LsaLookupNames"; File: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "LookupAccountSidLocalW" (Indicator: "LookupAccountSid"; Source: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "LookupAccountNameLocalW" (Indicator: "LookupAccountName"; Source: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "LsaLookupNames2" (Indicator: "LsaLookupNames"; Source: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "LsaLookupSids" (Indicator: "LsaLookupSids"; Source: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "LsaLookupNames" (Indicator: "LsaLookupNames"; Source: "00000000-00007632.00000000.141611.00E01000.00000020.mdmp") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "NetUserEnum" (Indicator: "NetUserEnum"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "NetWkstaUserGetInfo" (Indicator: "NetWkstaUserGetInfo"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")65:T435,"1801923906b6afe1dd3f32480f4e29f8.tmp" called "FindFirstFileA" with parameter %TEMP%\is-FJQA3.tmp\1801923906b6afe1dd3f32480f4e29f8.tmp (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\av*.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\bass_ape.dll (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\uninstall\unins???.* (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\stuff\date.txt (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\stuff\tagsreplace.txt (UID: 00000000-00005056) "1801923906b6afe1dd3f32480f4e29f8.tmp" called "FindFirstFileA" with parameter %PROGRAMFILES%\(x86)\CRTGame\bin\x86\tak_deco_lib.dll (UID: 00000000-00005056)66:T43c,Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp")67:Te5c,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-MGSS8.tmp") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-5B1CE.tmp") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-JL83O.tmp") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-176E6.tmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp")68:T7aa,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-MGSS8.tmp") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-5B1CE.tmp") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-JL83O.tmp") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-176E6.tmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")69:T5b8,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") file/memory contains long string with (Indicator: "GetProcAddress"; File: "is-MGSS8.tmp") file/memory contains long string with (Indicator: "GetProcAddress"; File: "is-5B1CE.tmp") file/memory contains long string with (Indicator: "GetProcAddress"; File: "is-JL83O.tmp") file/memory contains long string with (Indicator: "GetProcAddress"; File: "is-176E6.tmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.00401000.00000020.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")6a:T107c,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp")6b:T471,Found string "Where should [name] be installed?" (Indicator: "where "; Source: "00000000-00002948.00000000.140823.04D00000.00000004.mdmp") Found string "Where should Setup place the program's shortcuts?" (Indicator: "where "; Source: "00000000-00002948.00000000.140823.04D00000.00000004.mdmp") Found string "Where should [name] be installed?" (Indicator: "where "; Source: "00000000-00005056.00000000.140882.04EF8000.00000004.mdmp, 00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found string "Where should Setup place the program's shortcuts?" (Indicator: "where "; Source: "00000000-00005056.00000000.140882.04EF8000.00000004.mdmp, 00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found string "Where should CRTGame be installed?" (Indicator: "where "; Source: "00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp")6c:T634,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")6d:T486,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00002948.00000000.140823.04D00000.00000004.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.04EF8000.00000004.mdmp, 00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")6e:T608,Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00002948.00000000.140823.04D00000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00002948.00000000.140823.04D00000.00000004.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00002948.00000000.140823.04D00000.00000004.mdmp") Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00005056.00000000.140882.04EF8000.00000004.mdmp, 00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00005056.00000000.140882.04EF8000.00000004.mdmp, 00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00005056.00000000.140882.04EF8000.00000004.mdmp, 00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp")6f:T6bf,"Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 44279-677-00477940 "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 44279-788-00471FB4 "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 44279-3132-0046E080 "oftware\Microsoft\Windows\CurrentVersion\Uninstall\CRTGame_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005056.00000000.140882.02E80000.00000004.mdmp 00000000-00005056.00000001.141788.02E80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\CRTGame_L" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005056.00000000.140882.04F10000.00000004.mdmp 00000000-00005056.00000001.141788.04F10000.00000004.mdmp "?Software\Microsoft\Windows\CurrentVersion\Uninstall\CRTGame_is1P" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005056.00000000.140882.04F10000.00000004.mdmp 00000000-00005056.00000001.141788.04F10000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00005056.00000001.141788.00401000.00000020.mdmp70:T69e,Found registry deletion API: "RegDeleteKeyA" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found registry deletion API: "RegDeleteValueA" in file "1801923906b6afe1dd3f32480f4e29f8.exe" Found registry deletion API: "RegDeleteValueA" in "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyIfEmpty" in "00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyExA" in "00000000-00005056.00000001.141788.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00005056.00000001.141788.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00005056.00000001.141788.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in "00000000-00005056.00000001.141788.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00005056.00000001.141788.73A91000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00005056.00000001.141788.73A91000.00000020.mdmp"71:Tae0,Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);" (Indicator: "DeleteFile"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;" (Indicator: "DeleteFile"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "function DeleteFile(const FileName: string): Boolean;" (Indicator: "DeleteFile"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.00401000.00000020.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found reference to API "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);" (Indicator: "DeleteFile"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "function DeleteFile(const FileName: string): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp")72:T92c,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "SetWinEventHook" (Indicator: "SetWinEventHook"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "UnhookWinEvent" (Indicator: "UnhookWinEvent"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp")73:T70f,Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002948.00000000.140823.00401000.00000020.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp")74:T1115,Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")75:T99a,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") file/memory contains long string with (Indicator: "ExitProcess"; File: "is-MGSS8.tmp") file/memory contains long string with (Indicator: "ExitProcess"; File: "is-5B1CE.tmp") file/memory contains long string with (Indicator: "ExitProcess"; File: "is-JL83O.tmp") file/memory contains long string with (Indicator: "ExitProcess"; File: "is-176E6.tmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000000.140823.04D00000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.04EF8000.00000004.mdmp, 00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp, 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "ExitProcessT" (Indicator: "ExitProcess"; Source: "00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")76:T4be,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000000.140823.04D00000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.04EF8000.00000004.mdmp, 00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp, 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00007632.00000000.141611.00E2B000.00000002.mdmp")77:T4a2,"1801923906b6afe1dd3f32480f4e29f8.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IS-FJQA3.TMP\1801923906B6AFE1DD3F32480F4E29F8.TMP"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\SCHTASKS.EXE"; Value: "") "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\CRTGAME\CRTGAME.EXE"; Value: ""), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\NET.EXE"; Value: ""), "net1.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "")78:Td93,"1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CRTGAME\CRTG12102"; Key: "INSTALLPATH_WIN32"; Value: "%PROGRAMFILES%\(x86)\CRTGame"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "INNO SETUP: SETUP VERSION"; Value: "5.4.0 (a)"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "INNO SETUP: APP PATH"; Value: "%PROGRAMFILES%\(x86)\CRTGame"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "INSTALLLOCATION"; Value: "%PROGRAMFILES%\(x86)\CRTGame\"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "INNO SETUP: ICON GROUP"; Value: "CRTGame"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "INNO SETUP: USER"; Value: "HAPUBWS"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "INNO SETUP: LANGUAGE"; Value: "english"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "DISPLAYNAME"; Value: "CRTGame 1.2.1.0"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "UNINSTALLSTRING"; Value: ""%PROGRAMFILES%\(x86)\CRTGame\uninstall\unins000.exe""), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "QUIETUNINSTALLSTRING"; Value: ""%PROGRAMFILES%\(x86)\CRTGame\uninstall\unins000.exe" /SILENT"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "DISPLAYVERSION"; Value: "1.2.1.0"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "NOMODIFY"; Value: "0100000000"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "NOREPAIR"; Value: "0100000000"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "INSTALLDATE"; Value: "20261001"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "MAJORVERSION"; Value: "0100000000"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "MINORVERSION"; Value: "0200000000"), "1801923906b6afe1dd3f32480f4e29f8.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CRTGAME_IS1"; Key: "ESTIMATEDSIZE"; Value: "C638000000")79:T980,Found reference to API "CreateMutex" (Indicator: "CreateMutex"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "CreateMutexW" (Indicator: "CreateMutex"; File: "1801923906b6afe1dd3f32480f4e29f8.exe") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00002180.00000000.141597.004C7000.00000002.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00002448.00000001.141271.004C7000.00000002.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.00401000.00000020.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00005056.00000000.140882.73AF7000.00000002.mdmp") Found reference to API "CreateMutex" (Indicator: "CreateMutex"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp") Found reference to API "procedure CreateMutex(const Name: String);" (Indicator: "CreateMutex"; Source: "00000000-00005056.00000001.141788.00401000.00000020.mdmp")7a:T2cea,"crtgame.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\crtgame.exe]- [targetUID: 00000000-00002448] "_isdecmp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-SKO5G.tmp\_isetup\_isdecmp.dll]- [targetUID: 00000000-00005056] "_iscrypt.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections"- Location: [%TEMP%\is-SKO5G.tmp\_isetup\_iscrypt.dll]- [targetUID: 00000000-00005056] "is-I1F17.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 9 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-I1F17.tmp]- [targetUID: 00000000-00005056] "is-US632.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-US632.tmp]- [targetUID: 00000000-00005056] "is-TH4QT.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-TH4QT.tmp]- [targetUID: 00000000-00005056] "is-BDUOT.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 18 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-BDUOT.tmp]- [targetUID: 00000000-00005056] "is-2GT0F.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-2GT0F.tmp]- [targetUID: 00000000-00005056] "is-O6COR.tmp" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-O6COR.tmp]- [targetUID: 00000000-00005056] "is-1SS2O.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\uninstall\is-1SS2O.tmp]- [targetUID: 00000000-00005056] "1801923906b6afe1dd3f32480f4e29f8.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- Location: [%TEMP%\is-FJQA3.tmp\1801923906b6afe1dd3f32480f4e29f8.tmp]- [targetUID: 00000000-00002948] "is-RCUG2.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-RCUG2.tmp]- [targetUID: 00000000-00005056] "is-2DNUI.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-2DNUI.tmp]- [targetUID: 00000000-00005056] "is-B3Q5N.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-B3Q5N.tmp]- [targetUID: 00000000-00005056] "is-B8KI1.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-B8KI1.tmp]- [targetUID: 00000000-00005056] "is-FVU8F.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-FVU8F.tmp]- [targetUID: 00000000-00005056] "is-JKLUF.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-JKLUF.tmp]- [targetUID: 00000000-00005056] "is-1782F.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-1782F.tmp]- [targetUID: 00000000-00005056] "is-OA108.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-OA108.tmp]- [targetUID: 00000000-00005056] "is-99HP5.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 6 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-99HP5.tmp]- [targetUID: 00000000-00005056] "is-E9RN0.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-E9RN0.tmp]- [targetUID: 00000000-00005056] "is-6GFSE.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-6GFSE.tmp]- [targetUID: 00000000-00005056] "is-CLTQM.tmp" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-CLTQM.tmp]- [targetUID: 00000000-00005056] "is-ACO5V.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-ACO5V.tmp]- [targetUID: 00000000-00005056] "is-5FSBO.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-5FSBO.tmp]- [targetUID: 00000000-00005056] "is-741AF.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-741AF.tmp]- [targetUID: 00000000-00005056] "is-7PEIO.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-7PEIO.tmp]- [targetUID: 00000000-00005056] "is-JL38M.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-JL38M.tmp]- [targetUID: 00000000-00005056] "is-EJ5GB.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 8 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-EJ5GB.tmp]- [targetUID: 00000000-00005056] "is-N4GF7.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-N4GF7.tmp]- [targetUID: 00000000-00005056] "is-5FO09.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-5FO09.tmp]- [targetUID: 00000000-00005056] "is-1UES2.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-1UES2.tmp]- [targetUID: 00000000-00005056] "is-ND5O5.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 11 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-ND5O5.tmp]- [targetUID: 00000000-00005056] "is-HGR7I.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-HGR7I.tmp]- [targetUID: 00000000-00005056] "is-16HGU.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-16HGU.tmp]- [targetUID: 00000000-00005056] "is-EC3TD.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-EC3TD.tmp]- [targetUID: 00000000-00005056] "is-75RCA.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-75RCA.tmp]- [targetUID: 00000000-00005056] "is-OUL4D.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-OUL4D.tmp]- [targetUID: 00000000-00005056] "is-TL616.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-TL616.tmp]- [targetUID: 00000000-00005056] "is-7G6C6.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-7G6C6.tmp]- [targetUID: 00000000-00005056] "is-SRUKB.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-SRUKB.tmp]- [targetUID: 00000000-00005056] "is-D07S7.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-D07S7.tmp]- [targetUID: 00000000-00005056] "is-9KF1S.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\plugins\internal\is-9KF1S.tmp]- [targetUID: 00000000-00005056] "is-R5S1L.tmp" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 (stripped to external PDB) 8 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-R5S1L.tmp]- [targetUID: 00000000-00005056] "is-T8HGN.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-T8HGN.tmp]- [targetUID: 00000000-00005056] "is-E905S.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-E905S.tmp]- [targetUID: 00000000-00005056] "is-0JIV2.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-0JIV2.tmp]- [targetUID: 00000000-00005056] "is-2FR1F.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-2FR1F.tmp]- [targetUID: 00000000-00005056] "is-7VHIE.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\plugins\internal\is-7VHIE.tmp]- [targetUID: 00000000-00005056] "is-TEH5V.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-TEH5V.tmp]- [targetUID: 00000000-00005056] "is-5V2FQ.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-5V2FQ.tmp]- [targetUID: 00000000-00005056] "is-MGSS8.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-MGSS8.tmp]- [targetUID: 00000000-00005056] "is-5B1CE.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-5B1CE.tmp]- [targetUID: 00000000-00005056] "is-JL83O.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-JL83O.tmp]- [targetUID: 00000000-00005056] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-SKO5G.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00005056] "is-176E6.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-176E6.tmp]- [targetUID: 00000000-00005056] "_RegDLL.tmp" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 3 sections"- Location: [%TEMP%\is-SKO5G.tmp\_isetup\_RegDLL.tmp]- [targetUID: 00000000-00005056] "is-EVVCU.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 7 sections"- Location: [%PROGRAMFILES%\(x86)\CRTGame\bin\x86\is-EVVCU.tmp]- [targetUID: 00000000-00005056]7b:T2e1b,"1801923906b6afe1dd3f32480f4e29f8.exe" wrote 48640 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\1801923906b6afe1dd3f32480f4e29f8.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 4096 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-SKO5G.tmp\_isetup\_RegDLL.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-SKO5G.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 23312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-SKO5G.tmp\_isetup\_shfoldr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 19456 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-SKO5G.tmp\_isetup\_isdecmp.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 2560 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-SKO5G.tmp\_isetup\_iscrypt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 11532 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-MGSS8.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400ffffff560000000000000000ff0002210b010a000c030000002800000000000004ff000000100000005000000000001000100000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 39304 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-EC3TD.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 8456 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-5B1CE.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400230a4d5a0000000000000000ff0002210b010a0008030000001c0000000000000470000000100000003000000000001000100000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 18966 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-E905S.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c01040039230a5d0000000000000000ff0002210b010a0016060000004200000000000004ff000000100000007000000000001000100000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 36752 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-75RCA.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 19008 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-T8HGN.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400092b76530000000000000000ff0002210b010a0036ff000036ff00000000000036ff000000100000007000000000001000100000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 17472 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-0JIV2.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400ff5eff4c0000000000000000ff000e210b0106002576000025ff00000000000036ff000000100000006000000000101000100000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 35588 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-TL616.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400ff0679580000000000000000ff0002210b010a000403000000ff0000000000000440010000100000000001000000001000100000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 34392 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-7G6C6.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 36416 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-OUL4D.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400ff7dff510000000000000000ff000e210b010600ffff0200ff17030000000000362003000010000000ff00000000601000100000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 7910 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-JL83O.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400ffffff560000000000000000ff0002210b010a00ff020000001a0000000000000470000000100000003000000000001000100000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 62478 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-HGR7I.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 26126 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-D07S7.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 5960 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-176E6.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400ffffff490000000000000000ff000e210b0106000234000002540000000000003660000000100000002000000000001000100000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 43520 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-16HGU.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 13838 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-5V2FQ.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 31936 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-SRUKB.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 15374 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-TEH5V.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 22542 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-R5S1L.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 16910 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\is-2FR1F.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 15374 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-7VHIE.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 25614 bytes starting with PE header signature to file "C:\Program Files (x86)\CRTGame\bin\x86\plugins\internal\is-9KF1S.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...7c:T54c,"1801923906b6afe1dd3f32480f4e29f8.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\1801923906b6afe1dd3f32480f4e29f8.tmp" (Handle: 596) "1801923906b6afe1dd3f32480f4e29f8.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-FJQA3.tmp\1801923906b6afe1dd3f32480f4e29f8.tmp" (Handle: 596) "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 00000FB8 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1068) "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1068) "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\CRTGame\crtgame.exe" (Handle: 1084) "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\CRTGame\crtgame.exe" (Handle: 1084) "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 00000FB8 bytes to a remote process "C:\Windows\SysWOW64\net.exe" (Handle: 1072) "1801923906b6afe1dd3f32480f4e29f8.tmp" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\net.exe" (Handle: 1072) "net.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\SysWOW64\net1.exe" (Handle: 316) "net.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\net1.exe" (Handle: 316)7d:T400,AAABAAEAICAQ+wAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==7e:T400,AAABAAEAICAQ+wAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==7f:T400,AAABAAEAICAQ+wAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":81,"unified_at_epoch_ms":1790883721704,"unified_at":"2026-10-01T19:42:01.704Z","metadata":{"hashes":{"sha256":"dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","sha1":"0571464c48e068116349e9b5c9192f815616e442","md5":"1801923906b6afe1dd3f32480f4e29f8","sha512":"21f406c47a7ab86e2b68c91e3e1348225de7e853155d4ec611c940198fcd41d8a3dab9c7fec420481b3774de07af15623b7e7f06cd11d9e4ebcf214522f724bb","ssdeep":"196608:3A89BmaeXRdyXFnlUrU7o7Bz3HzNNn1jnNnTfMImG0zj:jBmakyVnlUQ7Wz3Tv1jNTh0zj","ssdeep_chunks":["196608:3A89Bma","196608:A89Bmae","196608:89BmaeX","196608:9BmaeXR","196608:BmaeXRd","196608:maeXRdy","196608:aeXRdyX","196608:eXRdyXF","196608:XRdyXFn","196608:RdyXFnl","196608:dyXFnlU","196608:yXFnlUr","196608:XFnlUrU","196608:FnlUrU7","196608:nlUrU7o","196608:lUrU7o7","196608:UrU7o7B","196608:rU7o7Bz","196608:U7o7Bz3","196608:7o7Bz3H","196608:o7Bz3Hz","196608:7Bz3HzN","196608:Bz3HzNN","196608:z3HzNNn","196608:3HzNNn1","196608:HzNNn1j","196608:zNNn1jn","196608:NNn1jnN","196608:Nn1jnNn","196608:n1jnNnT","196608:1jnNnTf","196608:jnNnTfM","196608:nNnTfMI","196608:NnTfMIm","196608:nTfMImG","196608:TfMImG0","196608:fMImG0z","196608:MImG0zj","393216:3A89Bma","393216:A89Bmae","393216:89BmaeX","393216:9BmaeXR","393216:BmaeXRd","393216:maeXRdy","393216:aeXRdyX","393216:eXRdyXF","393216:XRdyXFn","393216:RdyXFnl","393216:dyXFnlU","393216:yXFnlUr","393216:XFnlUrU","393216:FnlUrU7","393216:nlUrU7o","393216:lUrU7o7","393216:UrU7o7B","393216:rU7o7Bz","393216:U7o7Bz3","393216:7o7Bz3H","393216:o7Bz3Hz","393216:7Bz3HzN","393216:Bz3HzNN","393216:z3HzNNn","393216:3HzNNn1","393216:HzNNn1j","393216:zNNn1jn","393216:NNn1jnN","393216:Nn1jnNn","393216:n1jnNnT","393216:1jnNnTf","393216:jnNnTfM","393216:nNnTfMI","393216:NnTfMIm","393216:nTfMImG","393216:TfMImG0","393216:fMImG0z","393216:MImG0zj","196608:jBmakyV","196608:BmakyVn","196608:makyVnl","196608:akyVnlU","196608:kyVnlUQ","196608:yVnlUQ7","196608:VnlUQ7W","196608:nlUQ7Wz","196608:lUQ7Wz3","196608:UQ7Wz3T","196608:Q7Wz3Tv","196608:7Wz3Tv1","196608:Wz3Tv1j","196608:z3Tv1jN","196608:3Tv1jNT","196608:Tv1jNTh","196608:v1jNTh0","196608:1jNTh0z","196608:jNTh0zj"],"imphash":"884310b1928934402ea6fec1dbd3cf5e","pehash":"14a52baa068c28b0cec8104f84d8bff98b67f281"},"file_info":{"file_name":"dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","file_type":["compressed","innosetup"],"file_type_id":"innosetup","file_size":7232201,"entropy":8,"compile_timestamp":"2023-12-10T20:32:26","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790445163000,"last_seen":1790883545000,"last_multi_scan":1790883545000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":"CODE","virtual_address":"0x1000","virtual_size":37732,"raw_size":37888},{"name":"DATA","virtual_address":"0xb000","virtual_size":588,"raw_size":1024},{"name":"BSS","virtual_address":"0xc000","virtual_size":3660},{"name":".idata","virtual_address":"0xd000","virtual_size":2384,"raw_size":2560},{"name":".tls","virtual_address":"0xe000","virtual_size":8},{"name":".rdata","virtual_address":"0xf000","virtual_size":24,"raw_size":512},{"name":".reloc","virtual_address":"0x10000","virtual_size":2228},{"name":".rsrc","virtual_address":"0x11000","virtual_size":11264,"raw_size":11264}],"section_names":["CODE","DATA","BSS",".idata",".tls",".rdata",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":81,"tags":["evasive"]},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":93},"sandbox_signatures":{"informative_count":234,"suspicious_count":13,"malicious_count":3,"total":250},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Injuke","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.Injuke.gen.idop.arc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wacatac.dg!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ce05c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.AHSB-3919","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UNE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Injuke.Win32.38363","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"},{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Contains ability to access the loader directly (API string)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"suspicious","value":"Contains ability to open/control a service"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"informative","value":"Contains ability to add users to a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"Junk code insertion patterns detected"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve state data for the computer (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Tries to query scheduled tasks"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"},{"type":"informative","value":"Attempts to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Permission Groups Discovery","attack_id":"T1069","attack_id_wiki":"https://attack.mitre.org/techniques/T1069","identifiers":[{"type":"informative","value":"Contains ability to enumerate user groups or their members (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Domain Trust Discovery","attack_id":"T1482","attack_id_wiki":"https://attack.mitre.org/techniques/T1482","identifiers":[{"type":"informative","value":"Contains ability to retrieve Domain Trust data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Collection","technique":"Archive via Utility","attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"YARA signature match - Detects 7zip files"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"},{"type":"informative","value":"Contains ability to delete users from a group (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"is-FVU8F.tmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"Found reference string \"NetGroupGetInfo\" (Indicator: \"netgroupgetinfo\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference string \"NetGroupGetUsers\" (Indicator: \"netgroupgetusers\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference string \"NetGroupEnum\" (Indicator: \"netgroupenum\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference string \"NetUserGetGroups\" (Indicator: \"netusergetgroups\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" called \"FindResourceA\" with parameter \"11111\" - (UID: 00000000-00002948)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"FindResourceA\" with parameter \"4700044\" - (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"FindResourceA\" with parameter \"4553564\" - (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"FindResourceA\" with parameter \"4700752\" - (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"FindResourceA\" with parameter \"83026936\" - (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"FindResourceA\" with parameter \"83032792\" - (UID: 00000000-00005056)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4264704'}\" (UID: 00000000-00002948)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4893016'}\" (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4893000'}\" (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4893032'}\" (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4893048'}\" (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4893144'}\" (UID: 00000000-00005056)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\is-FJQA3.tmp (UID: 00000000-00002948)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; File: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005056.00000000.140882.04EF8000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005056.00000000.140882.04F10000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005056.00000001.141788.004A0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005056.00000001.141788.04EF8000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005056.00000001.141788.04F10000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"1801923906b6afe1dd3f32480f4e29f8.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" set its error mode to SEM_FAILCRITICALERRORS\n \"schtasks.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"crtgame.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"crtgame.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"net1.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"net1.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2b","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00007376]\n Process \"WerFault.exe\" [UID: 00000000-00004060]\n Process \"WerFault.exe\" [UID: 00000000-00004856]\n Process \"WerFault.exe\" [UID: 00000000-00003876]\n Process \"WerFault.exe\" [UID: 00000000-00003496]\n Process \"WerFault.exe\" [UID: 00000000-00007992]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00007632-50609-19-00E06F60\n SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00007632-50609-22-00E06D16","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"$2c","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found api reference \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContext\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002180.00000000.141597.02B20000.00000004.mdmp, 00000000-00002180.00000001.141782.02B20000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002448.00000000.141098.02DA0000.00000004.mdmp, 00000000-00002448.00000001.141271.02DA0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002948.00000000.140823.02CA0000.00000004.mdmp, 00000000-00002948.00000001.141792.02CA0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005056.00000000.140882.02E80000.00000004.mdmp, 00000000-00005056.00000001.141788.02E80000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007632.00000000.141611.03310000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99942","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains key cryptographic functions (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005056.00000000.140882.73AF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"GetTickCount\" with parameters (UID: 00000000-00005056)\n \"crtgame.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002448)\n \"crtgame.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002180)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002948)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005056)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002948)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"IsWow64Process\" with parameter \"5056\" - (UID: 00000000-00005056)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"EnumWindows\" with parameter \"13628464\" - (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"EnumWindows\" with parameter \"13628384\" - (UID: 00000000-00005056)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"GetWindowTextA\" with parameter \"Setup\" - (UID: 00000000-00005056)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"GetActiveWindow\" (UID: 00000000-00005056)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002948)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005056)\n \"crtgame.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002448)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"OpenMutexA\" with parameter \"058293A95B8754C3338350983E4D42E4\" - (UID: 00000000-00005056)\n \"crtgame.exe\" called \"OpenMutexA\" with parameter \"AnyMediaPlayer\" - (UID: 00000000-00002448)\n \"crtgame.exe\" called \"OpenMutexA\" with parameter \"AnyMediaPlayer\" - (UID: 00000000-00002180)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00002948)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00005056-44279-8-0047B804\n GetTickCount@KERNEL32.DLL at 00000000-00005056-44279-727-0042ECBC\n GetTickCount@KERNEL32.DLL at 00000000-00005056-44279-730-0042ECA4\n GetTickCount@KERNEL32.DLL at 00000000-00005056-44279-839-00457CE8\n GetTickCount@KERNEL32.DLL at 00000000-00005056-44279-3116-00476714\n GetTickCount@KERNEL32.DLL at 00000000-00005056-44279-3179-004817FC\n GetTickCount@KERNEL32.DLL at 00000000-00005056-44279-3523-00495488\n GetTickCount@KERNEL32.DLL at 00000000-00005056-44279-4553-0047B7B0\n GetTickCount@KERNEL32.DLL at 00000000-00005056-44279-4717-0049469C\n GetTickCount@KERNELBASE.DLL at 00000000-00007632-50609-311-00E07163","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileA@KERNEL32.DLL at 00000000-00005056-44279-88-0045363C\n FindFirstFileA@KERNEL32.DLL at 00000000-00005056-44279-101-004520C0\n FindNextFileA@KERNEL32.DLL at 00000000-00005056-44279-611-0047E350\n FindNextFileA@KERNEL32.DLL at 00000000-00005056-44279-806-00471114\n FindNextFileA@KERNEL32.DLL at 00000000-00005056-44279-2800-00453910\n FindFirstFileA@KERNEL32.DLL at 00000000-00005056-44279-2948-00461E78\n FindFirstFileA@KERNEL32.DLL at 00000000-00005056-44279-2987-00463404\n FindFirstFileA@KERNEL32.DLL at 00000000-00005056-44279-2995-00463880\n FindNextFileA@KERNEL32.DLL at 00000000-00005056-44279-3086-0047C274\n FindFirstFileA@KERNEL32.DLL at 00000000-00005056-44279-3158-00473F08\n FindFirstFileA@KERNEL32.DLL at 00000000-00005056-44279-3527-00496568","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00005056-44279-2985-0046331C\n GetDriveTypeA@KERNEL32.DLL at 00000000-00005056-44279-2993-00463728\n GetDriveTypeW@KERNELBASE.DLL at 00000000-00007632-50609-196-00E0F46B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00002180.00000000.141597.004C7000.00000002.mdmp\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00002448.00000001.141271.004C7000.00000002.mdmp\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005056-44279-82-00456C04\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00005056-44279-823-0046D638\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005056-44279-839-00457CE8\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005056-44279-2841-00456BC0\n GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00007632-50609-311-00E07163","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00000000-00002948-43388-118-0040102C\n GetSystemTime@KERNEL32.DLL at 00000000-00002948-43388-154-004026C4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005056-44279-82-00456C04\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005056-44279-839-00457CE8\n GetSystemTime@KERNEL32.DLL at 00000000-00005056-44279-2013-00402778\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005056-44279-2841-00456BC0\n GetLocalTime@KERNEL32.DLL at 00000000-00005056-44279-3130-0046D964\n GetLocalTime@KERNEL32.DLL at 00000000-00005056-44279-3137-0046DF10\n GetLocalTime@KERNEL32.DLL at 00000000-00005056-44279-3463-00407DB0\n GetLocalTime@KERNEL32.DLL at 00000000-00005056-44279-3464-00407D84\n GetSystemTimeAsFileTime@KERNELBASE.DLL at 00000000-00007632-50609-311-00E07163","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNELBASE.DLL at 00000000-00007632-50609-210-00E1B623","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$3a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00002948-43388-162-004051FC\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002948-43388-168-00405248\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005056-44279-2030-00408570\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00005056-44279-2034-004085BC\n GetUserDefaultLCID@KERNELBASE.DLL at 00000000-00007632-50609-209-00E11CF2\n GetUserDefaultLCID@KERNELBASE.DLL at 00000000-00007632-50609-227-00E11DDC\n GetUserDefaultLCID@KERNELBASE.DLL at 00000000-00007632-50609-348-00E0B532","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00005056-44279-2820-00455328","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"1801923906b6afe1dd3f32480f4e29f8.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"crtgame.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"net1.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00002948-43388-288-00409B30\n GetSystemInfo@KERNEL32.DLL at 00000000-00005056-44279-3283-00481DF0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005056.00000001.141788.004A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00002948-43388-212-00407024\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00002948-43388-261-0040953C\n GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005056-44279-2523-0042E340\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00005056-44279-2824-00455610","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00002948-43388-420-004043A2\n OpenProcessToken@ADVAPI32.DLL at 00000000-00005056-44279-477-00454B00\n OpenProcessToken@ADVAPI32.DLL at 00000000-00005056-44279-2521-0042DFC4\n OpenProcessToken@ADVAPI32.DLL at 00000000-00005056-44279-3256-00476CAC\n OpenProcess@KERNEL32.DLL at 00000000-00005056-44279-3510-00494950\n NtOpenProcessToken@NTDLL.DLL at 00000000-00007632-50609-226-00E1B67F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$3e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\IS-SKO5G.TMP\\_ISETUP\\_ISCRYPT.DLL\n %TEMP%\\IS-SKO5G.TMP\\_ISETUP\\_ISDECMP.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\CRTGAME_IS1\")\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\CRTGAME_IS1\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to query scheduled tasks","description":"Process \"schtasks.exe\" with commandline \"/Query\" (UID: 00000000-00004204)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":3,"id":"target-280","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyEx\" in file \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in file \"1801923906b6afe1dd3f32480f4e29f8.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00005056.00000000.140882.73AF7000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")\n Found reference to API \"EnumDependentServicesW\" (Indicator: \"EnumDependentServices\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"is-99HP5.tmp\")\n file/memory contains long string(File: \"is-CLTQM.tmp\")\n file/memory contains long string(File: \"is-5FSBO.tmp\")\n file/memory contains long string(File: \"is-N4GF7.tmp\")\n file/memory contains long string(File: \"is-5FO09.tmp\")\n file/memory contains long string(File: \"_setup64.tmp\")\n file/memory contains long string(File: \"_RegDLL.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005056.00000000.140882.73AF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00002180.00000000.141597.004C7000.00000002.mdmp\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00002448.00000001.141271.004C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"crtgame.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3f","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\is-FJQA3.tmp\\1801923906b6afe1dd3f32480f4e29f8.tmp\" /SL5=\"$301D8\n6977575\n54272\nC:\\1801923906b6afe1dd3f32480f4e29f8.exe\"\" - (UID: 00000000-00002948)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"CreateProcessA\" with parameter \"\"%WINDIR%\\system32\\schtasks.exe\" /Query\" - (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"CreateProcessA\" with parameter \"\"%PROGRAMFILES%\\(x86)\\CRTGame\\crtgame.exe\" -i\" - (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"CreateProcessA\" with parameter \"\"%WINDIR%\\system32\\net.exe\" helpmsg 10\" - (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"CreateProcessA\" with parameter \"\"%PROGRAMFILES%\\(x86)\\CRTGame\\crtgame.exe\" -s\" - (UID: 00000000-00005056)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$41","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$42","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"net1.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to add users to a group (API string)","description":"Found reference to API \"NetGroupAdd\" (Indicator: \"NetGroupAdd\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference to API \"NetGroupAddUser\" (Indicator: \"NetGroupAdd\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference to API \"NetGroupAddUser\" (Indicator: \"NetGroupAddUser\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-215","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005056.00000001.141788.004A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeA@KERNEL32.DLL at 00000000-00005056-44279-839-00457CE8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$45","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002948-43388-211-00406FA0\n LoadLibraryA@KERNEL32.DLL at 00000000-00005056-44279-425-0042E2BC\n LoadLibraryA@KERNEL32.DLL at 00000000-00005056-44279-1131-0044F5A3\n LoadLibraryA@KERNEL32.DLL at 00000000-00005056-44279-1142-0044BF90\n LoadLibraryExA@KERNEL32.DLL at 00000000-00005056-44279-1223-00447D80\n LoadLibraryA@KERNEL32.DLL at 00000000-00005056-44279-3540-00463D1C\n LoadLibraryA@KERNEL32.DLL at 00000000-00005056-44279-3541-0044AEAC\n LoadLibraryA@KERNEL32.DLL at 00000000-00005056-44279-3554-0041F128\n LoadLibraryExW at 00000000-00007632-50609-30-00E05460\n LoadLibraryExW at 00000000-00007632-50609-42-00E187F7\n LoadLibraryExW at 00000000-00007632-50609-92-00E05710\n LoadLibraryExW at 00000000-00007632-50609-172-00E16723\n LoadLibraryExW at 00000000-00007632-50609-219-00E0CEB0\n LoadLibraryExW at 00000000-00007632-50609-305-00E1185B\n LoadLibraryExW at 00000000-00007632-50609-306-00E050A0\n LoadLibraryExW at 00000000-00007632-50609-392-00E0868F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00005056.00000000.140882.73AF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002180.00000000.141597.004C7000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002448.00000001.141271.004C7000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4c","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$4d","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$4e","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4f","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$50","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753A0000\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753A0000\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73A10000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753A0000\n \"crtgame.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753A0000\n \"net.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753A0000\n \"net.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73A10000\n \"net1.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753A0000\n \"net1.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73A10000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 751D0000\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 751D0000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 751D0000\n \"crtgame.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 751D0000\n \"net.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 751D0000\n \"net1.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 751D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$51","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" touched \"Microsoft Multiple AutoComplete List Container\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2765-6A77-11D0-A535-00C04FD7D062}\")\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" touched \"Microsoft Shell Folder AutoComplete List\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{03C036F1-A186-11D0-824A-00AA005B4383}\\TREATAS\")\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" touched \"Microsoft AutoComplete\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2763-6A77-11D0-A535-00C04FD7D062}\\TREATAS\")\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" touched \"Microsoft TipAutoCompleteClient Control\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\\TREATAS\")\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" touched \"Task Bar Communication\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\schtasks.exe\" [Source: 00000000-00005056-00000BC0-1193049565]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\net.exe\" [Source: 00000000-00005056-00000BC0-1200863302]\n Observed system executable string:\"\"%WINDIR%\\system32\\schtasks.exe\" /Query\" [Source: 00000000-00005056-00000C46-6891607651]\n Observed system executable string:\"\"%WINDIR%\\system32\\net.exe\" helpmsg 10\" [Source: 00000000-00005056-00000C46-25656118901]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"1801923906b6afe1dd3f32480f4e29f8.tmp\" (UID: 00000000-00005056) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"1801923906b6afe1dd3f32480f4e29f8.tmp\" (UID: 00000000-00005056) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$52","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\shlwapi.dll\" [Source: 00000000-00005056-00000C2B-1190886994]\n Observed system executable string:\"%WINDIR%\\system32\\sfc.dll\" [Source: 00000000-00005056-00000C2B-1191169473]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" searching for window \"L2aa25_GAST12101FlashFixClass_L2aa25\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"1801923906b6afe1dd3f32480f4e29f8.tmp\" with commandline \"/SL5=\"$301D8\n6977575\n54272\nC:\\\\1801923906b6afe1dd3f32480f4e29f8. ...\" (UID: 00000000-00005056), Spawned process \"schtasks.exe\" with commandline \"/Query\" (UID: 00000000-00004204), Spawned process \"crtgame.exe\" with commandline \"-i\" (UID: 00000000-00002448), Spawned process \"net.exe\" with commandline \"helpmsg 10\" (UID: 00000000-00002268), Spawned process \"crtgame.exe\" with commandline \"-s\" (UID: 00000000-00002180), Spawned process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 helpmsg 10\" (UID: 00000000-00007632)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"1801923906b6afe1dd3f32480f4e29f8.tmp\" with commandline \"/SL5=\"$301D8\n6977575\n54272\nC:\\\\1801923906b6afe1dd3f32480f4e29f8. ...\" (UID: 00000000-00005056), Spawned process \"schtasks.exe\" with commandline \"/Query\" (UID: 00000000-00004204), Spawned process \"crtgame.exe\" with commandline \"-i\" (UID: 00000000-00002448), Spawned process \"net.exe\" with commandline \"helpmsg 10\" (UID: 00000000-00002268), Spawned process \"crtgame.exe\" with commandline \"-s\" (UID: 00000000-00002180), Spawned process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 helpmsg 10\" (UID: 00000000-00007632)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$53","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-FJQA3.tmp\\1801923906b6afe1dd3f32480f4e29f8.tmp\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-SKO5G.tmp\\_isetup\\_RegDLL.tmp\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-SKO5G.tmp\\_isetup\\_setup64.tmp\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-SKO5G.tmp\\_isetup\\_shfoldr.dll\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-SKO5G.tmp\\_isetup\\_isdecmp.dll\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-SKO5G.tmp\\_isetup\\_iscrypt.dll\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"1801923906b6afe1dd3f32480f4e29f8.tmp\" with commandline \"/SL5=\"$301D8\n6977575\n54272\nC:\\\\1801923906b6afe1dd3f32480f4e29f8.exe\"\" (UID: 00000000-00005056)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; File: \"00000000-00002180.00000001.141782.0052C000.00000040.mdmp\")\n Found reference to API \"LdrGetDllHandle\" (Indicator: \"LdrGetDllHandle\"; Source: \"00000000-00002180.00000001.141782.0052C000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1129","relevance":1,"id":"string-548","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00000000-00005056-44279-717-00454AB8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$55","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$56","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"_isdecmp.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\is-SKO5G.tmp\\_isetup\\_isdecmp.dll]- [targetUID: 00000000-00005056]\n \"_iscrypt.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections\"- Location: [%TEMP%\\is-SKO5G.tmp\\_isetup\\_iscrypt.dll]- [targetUID: 00000000-00005056]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$58","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" reads file \"c:\\1801923906b6afe1dd3f32480f4e29f8.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00005056.00000001.141788.004A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$5a","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"1801923906b6afe1dd3f32480f4e29f8.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"1801923906b6afe1dd3f32480f4e29f8.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"1801923906b6afe1dd3f32480f4e29f8.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"1801923906b6afe1dd3f32480f4e29f8.exe\" trying to touch file \"C:\\1801923906b6afe1dd3f32480f4e29f8.exe\"\n \"1801923906b6afe1dd3f32480f4e29f8.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"1801923906b6afe1dd3f32480f4e29f8.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"1801923906b6afe1dd3f32480f4e29f8.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"1801923906b6afe1dd3f32480f4e29f8.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-fjqa3.tmp\\1801923906b6afe1dd3f32480f4e29f8.tmp\"\n \"1801923906b6afe1dd3f32480f4e29f8.exe\" writes file \"%temp%\\is-fjqa3.tmp\\1801923906b6afe1dd3f32480f4e29f8.tmp\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-sko5g.tmp\\_isetup\\_regdll.tmp\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-sko5g.tmp\\_isetup\\_setup64.tmp\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-sko5g.tmp\\_isetup\\_shfoldr.dll\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-sko5g.tmp\\_isetup\\_isdecmp.dll\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-sko5g.tmp\\_isetup\\_iscrypt.dll\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes file \"c:\\program files (x86)\\crtgame\\uninstall\\is-1ss2o.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes a file \"C:\\Program Files (x86)\\CRTGame\\uninstall\\unins000.dat\"\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" writes a file \"%PROGRAMFILES%\\(x86)\\CRTGame\\uninstall\\unins000.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; File: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap --open\"; File: \"is-FVU8F.tmp\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"NetShareGetInfo\" (Indicator: \"NetShareGetInfo\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference to API \"NetShareEnum\" (Indicator: \"NetShareEnum\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"Setup cannot continue at this time, shutdown negotiation is in progress. Click OK to retry.\" (Indicator: \" shutdown \"; File: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")\n Found reference to API \"Setup cannot continue at this time, shutdown negotiation is in progress. Click OK to retry.\" (Indicator: \" shutdown \"; Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")\n Found reference to API \"Duplicate CardId found\"An error returned from DDE ($0%x)/DDE Error - conversation not established ($0%x)0Error occurred when DDE ran out of memory ($0%x)\"Unable to connect DDE conversation\" (Indicator: \" connect \"; Source: \"00000000-00005056.00000001.141788.004A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.2.1.0\"\n Potential IP \"1.2.1.0\" found in string \"CRTGame 1.2.1.0\"\n \"1.0.0.0\"\n Potential IP \"1.2.1.0\" found in string \"This will install CRTGame 1.2.1.0 on your computer.\"\n \"51.52.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$60","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002448.00000000.141098.02DA0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002448.00000001.141271.02DA0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002948.00000000.140823.02CA0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002948.00000001.141792.02CA0000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00005056.00000000.140882.02E80000.00000004.mdmp\")\n Found URL \"http://www.innosetup.com/remobjects\" - Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")\n Found URL \"http://www.remobjects.com/pszyyd_^[y]exception\" - Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Detects 7zip files","description":"YARA signature for 7-Zip file file \"is-FVU8F.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1560.001","relevance":1,"id":"yara-176","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00005056.00000000.140882.04EF8000.00000004.mdmp, 00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00002948-43388-246-00408FAC\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002948-43388-247-00408F70\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002948-43388-250-004090A4\n Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00005056-44279-95-00451DC0\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00005056-44279-96-00451D84\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00005056-44279-2791-00452850","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00002948.00000000.140823.00401000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00002948.00000000.140823.00401000.00000020.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to enumerate permission groups in the domain","description":"NetGroupEnum@SAMCLI.DLL at 00000000-00007632-50609-118-00E0BDA8\n NetGroupGetInfo@SAMCLI.DLL at 00000000-00007632-50609-119-00E0BB73\n NetGroupGetUsers@SAMCLI.DLL at 00000000-00007632-50609-119-00E0BB73\n NetUserGetGroups@SAMCLI.DLL at 00000000-00007632-50609-235-00E1387F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1069.002","relevance":5,"id":"stream-141","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$65","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"crtgame.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"net1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"GetComputerNameA\" (UID: 00000000-00005056)\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"GetComputerNameW\" (UID: 00000000-00005056)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" called \"GetUserNameA\" (UID: 00000000-00005056)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"is-FVU8F.tmp\")\n file/memory contains long string with (Indicator: \"aes128\"; File: \"is-FVU8F.tmp\")\n file/memory contains long string with (Indicator: \"aes192\"; File: \"is-FVU8F.tmp\")\n file/memory contains long string with (Indicator: \"aes256\"; File: \"is-FVU8F.tmp\")\n Found string \"IPF_Base64InkSerializedFormatWWW\" (Indicator: \"base64\"; Source: \"00000000-00005056.00000000.140882.73AF7000.00000002.mdmp\")\n Found string \"IPF_Base64GIFWWWh\" (Indicator: \"base64\"; Source: \"00000000-00005056.00000000.140882.73AF7000.00000002.mdmp\")\n Found string \"Specifies that ink be persisted by encoding the ISF as a base64 stream.WWWi\" (Indicator: \"base64\"; Source: \"00000000-00005056.00000000.140882.73AF7000.00000002.mdmp\")\n Found string \"Specifies that ink be persisted by using a base64 encoded fortified GIF.WW1\" (Indicator: \"base64\"; Source: \"00000000-00005056.00000000.140882.73AF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00002180.00000000.141597.004C7000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00002448.00000001.141271.004C7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"NetServerEnum\" (Indicator: \"NetServerEnum\"; File: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")\n Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"NetServerEnum\" (Indicator: \"NetServerEnum\"; Source: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate user groups or their members (API string)","description":"Found reference to API \"NetGroupGetUsers\" (Indicator: \"NetGroupGetUsers\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference to API \"NetGroupEnum\" (Indicator: \"NetGroupEnum\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069","relevance":1,"id":"string-219","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.004A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve Domain Trust data (API string)","description":"Found reference to API \"DsGetDcNameW\" (Indicator: \"DsGetDcName\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1482","relevance":1,"id":"string-259","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameLocalW\" (Indicator: \"LookupAccountName\"; File: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")\n Found reference to API \"LsaLookupNames2\" (Indicator: \"LsaLookupNames\"; File: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")\n Found reference to API \"LsaLookupNames\" (Indicator: \"LsaLookupNames\"; File: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")\n Found reference to API \"LookupAccountNameLocalW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")\n Found reference to API \"LsaLookupNames2\" (Indicator: \"LsaLookupNames\"; Source: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")\n Found reference to API \"LsaLookupNames\" (Indicator: \"LsaLookupNames\"; Source: \"00000000-00007632.00000000.141611.00E01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"CsrGetProcessId\" (Indicator: \"GetProcessId\"; File: \"00000000-00002448.00000000.141098.0052F000.00000040.mdmp\")\n Found reference to API \"CsrGetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00002448.00000000.141098.0052F000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve state data for the computer (API string)","description":"Found reference to API \"DsRoleGetPrimaryDomainInformation\" (Indicator: \"DsRoleGetPrimaryDomainInformation\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-116","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; File: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"GetComputerNameString\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp\")\n Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002180.00000000.141597.004C7000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002448.00000001.141271.004C7000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002180.00000000.141597.004C7000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002448.00000001.141271.004C7000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002948.00000000.140823.04D00000.00000004.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000000.140882.04EF8000.00000004.mdmp, 00000000-00005056.00000000.140882.04F10000.00000004.mdmp, 00000000-00005056.00000000.140882.73AF7000.00000002.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.04EF8000.00000004.mdmp, 00000000-00005056.00000001.141788.04F10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005056.00000000.140882.73AF7000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005056.00000001.141788.73A91000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; File: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"00000000-00005056.00000001.141788.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete users from a group (API string)","description":"Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDelUser\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference to API \"NetGroupDelUser\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")\n Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-218","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002948.00000000.140823.02CA0000.00000004.mdmp, 00000000-00002948.00000001.141792.02CA0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005056.00000000.140882.02E80000.00000004.mdmp, 00000000-00005056.00000001.141788.02E80000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005056.00000000.140882.02E80000.00000004.mdmp\")\n Found string \"NDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005056.00000001.141788.02E80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002180.00000000.141597.004C7000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002448.00000001.141271.004C7000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005056.00000000.140882.73AF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" opened \"\\Device\\KsecDD\"\n \"net.exe\" opened \"\\Device\\KsecDD\"\n \"net1.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$77","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$78","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00007632.00000000.141611.00E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"1801923906b6afe1dd3f32480f4e29f8.exe\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00002948.00000000.140823.0040B000.00000004.mdmp, 00000000-00002948.00000001.141792.0040B000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00005056.00000000.140882.0049A000.00000004.mdmp, 00000000-00005056.00000001.141788.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"_isdecmp.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\is-SKO5G.tmp\\_isetup\\_isdecmp.dll]- [targetUID: 00000000-00005056]\n \"_iscrypt.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 3 sections\"- Location: [%TEMP%\\is-SKO5G.tmp\\_isetup\\_iscrypt.dll]- [targetUID: 00000000-00005056]\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections\"- Location: [%TEMP%\\is-FJQA3.tmp\\1801923906b6afe1dd3f32480f4e29f8.tmp]- [targetUID: 00000000-00002948]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"- Location: [%TEMP%\\is-SKO5G.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00005056]\n \"_RegDLL.tmp\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 3 sections\"- Location: [%TEMP%\\is-SKO5G.tmp\\_isetup\\_RegDLL.tmp]- [targetUID: 00000000-00005056]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"SetDllDirectoryW\" (Source: 1801923906b6afe1dd3f32480f4e29f8.exe, API is part of module: KERNEL32.DLL)\n Found string \"SetSearchPathMode\" (Source: 1801923906b6afe1dd3f32480f4e29f8.exe, API is part of module: KERNEL32.DLL)\n Found string \"SetProcessDEPPolicy\" (Source: 1801923906b6afe1dd3f32480f4e29f8.exe, API is part of module: KERNEL32.DLL)\n Found string \"Wow64DisableWow64FsRedirection\" (Source: 1801923906b6afe1dd3f32480f4e29f8.exe, API is part of module: KERNELBASE.DLL)\n Found string \"Wow64RevertWow64FsRedirection\" (Source: 1801923906b6afe1dd3f32480f4e29f8.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"crtgame.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"net1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Contains ability to open/control a service","description":"OpenServiceW@SECHOST.DLL at 00000000-00007632-50609-92-00E05710\n OpenServiceW@SECHOST.DLL at 00000000-00007632-50609-97-00E04E70\n OpenServiceW@SECHOST.DLL at 00000000-00007632-50609-305-00E1185B\n OpenServiceW@SECHOST.DLL at 00000000-00007632-50609-306-00E050A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1569.002","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Junk code insertion patterns detected","description":"Excessive NOP sled detected (128 consecutive NOPs) at offset 448511","origin":"Binary File","mitre_attack_id":"T1027.016","relevance":7,"id":"binary-9001","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"1801923906b6afe1dd3f32480f4e29f8.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\CRTGAME_IS1\"; Key: \"UNINSTALLSTRING\"; Value: \"\"%PROGRAMFILES%\\(x86)\\CRTGame\\uninstall\\unins000.exe\"\")\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\CRTGAME_IS1\"; Key: \"QUIETUNINSTALLSTRING\"; Value: \"\"%PROGRAMFILES%\\(x86)\\CRTGame\\uninstall\\unins000.exe\" /SILENT\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\SysWOW64\\schtasks.exe\" launched with commandline \"/Query\" (UID: 00000000-00004204)\n Process \"%WINDIR%\\SysWOW64\\net.exe\" launched with commandline \"helpmsg 10\" (UID: 00000000-00002268)\n Process \"%WINDIR%\\SysWOW64\\net1.exe\" launched with commandline \"%WINDIR%\\\\system32\\\\net1 helpmsg 10\" (UID: 00000000-00007632)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"crtgame.exe queries ProcessDebugPort (UID: 2448), \"crtgame.exe queries ProcessDebugPort (UID: 2180)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/27 Antivirus vendors marked sample as malicious (37% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00002948-43388-287-00409BEC\n FindResourceA@KERNEL32.DLL at 00000000-00005056-44279-287-0040AFD8\n FindResourceA@KERNEL32.DLL at 00000000-00005056-44279-310-0040D210\n FreeResource@KERNEL32.DLL at 00000000-00005056-44279-4920-0040D27C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$7a","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$7b","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00005056-44279-242-00406204\n SystemParametersInfoA@USER32.DLL at 00000000-00005056-44279-2956-00462400","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"system32\\wbem\\wmiprvse.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00007632.00000000.141611.03310000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"1801923906b6afe1dd3f32480f4e29f8.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-FJQA3.tmp\\1801923906b6afe1dd3f32480f4e29f8.tmp\" for deletion\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" marked \"C:\\Program Files (x86)\\CRTGame\\stuff\\date.txt\" for deletion\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" marked \"C:\\Program Files (x86)\\CRTGame\\stuff\\tagsreplace.txt\" for deletion\n \"1801923906b6afe1dd3f32480f4e29f8.tmp\" marked \"C:\\Program Files (x86)\\CRTGame\\bin\\x86\\tak_deco_lib.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00005056-44279-1848-00405E1C\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00005056-44279-2831-0045678C\n NtQuerySystemTime@NTDLL.DLL at 00000000-00007632-50609-216-00E1B5F5\n NtSetInformationThread@NTDLL.DLL at 00000000-00007632-50609-225-00E1B82E\n NtOpenProcessToken@NTDLL.DLL at 00000000-00007632-50609-226-00E1B67F\n NtQuerySystemTime@NTDLL.DLL at 00000000-00007632-50609-256-00E0D0FB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73520000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$7c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"1801923906b6afe1dd3f32480f4e29f8.exe\" (UID: 00000000-00002948)\n Spawned process \"1801923906b6afe1dd3f32480f4e29f8.tmp\" with commandline \"/SL5=\"$301D8\n6977575\n54272\nC:\\\\1801923906b6afe1dd3f32480f4e29f8.exe\"\" (UID: 00000000-00005056)\n Spawned process \"schtasks.exe\" with commandline \"/Query\" (UID: 00000000-00004204)\n Spawned process \"crtgame.exe\" with commandline \"-i\" (UID: 00000000-00002448)\n Spawned process \"net.exe\" with commandline \"helpmsg 10\" (UID: 00000000-00002268)\n Spawned process \"crtgame.exe\" with commandline \"-s\" (UID: 00000000-00002180)\n Spawned process \"net1.exe\" with commandline \"%WINDIR%\\\\system32\\\\net1 helpmsg 10\" (UID: 00000000-00007632)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to query information about shared network resources"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Able to discover network shares"}],"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]}],"intel_graph":{"map":{"File:00fb8e819ffdd2c246f0e6c8c3767a08e704812c6443c8d657dfb388aeb27cf9":{"type":"File","value":"00fb8e819ffdd2c246f0e6c8c3767a08e704812c6443c8d657dfb388aeb27cf9"},"File:0afe688b6fca94c69780f454be65e12d616c6e6376e80c5b3835e3fa6de3eb8a":{"type":"File","value":"0afe688b6fca94c69780f454be65e12d616c6e6376e80c5b3835e3fa6de3eb8a"},"File:2581a6bca6f4b307658b24a7584a6b300c91e32f2fe06eb1dca00adce60fa723":{"type":"File","value":"2581a6bca6f4b307658b24a7584a6b300c91e32f2fe06eb1dca00adce60fa723"},"File:2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc":{"type":"File","value":"2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc"},"File:38a75f86db58eb8d2a7c0213861860a64833c78f59eff19141ffd6c3b6e28835":{"type":"File","value":"38a75f86db58eb8d2a7c0213861860a64833c78f59eff19141ffd6c3b6e28835"},"File:4824a06b819cbe49c485d68a9802d9dae3e3c54d4c2d8b706c8a87b56ceefbf3":{"type":"File","value":"4824a06b819cbe49c485d68a9802d9dae3e3c54d4c2d8b706c8a87b56ceefbf3"},"File:4e9f3e74e984b1c6e4696717ae36396e7504466419d8e4323af3a89de2e2b784":{"type":"File","value":"4e9f3e74e984b1c6e4696717ae36396e7504466419d8e4323af3a89de2e2b784"},"File:574595b5fd6223e4a004fa85cbb3588c18cc6b83bf3140d8f94c83d11dbca7bd":{"type":"File","value":"574595b5fd6223e4a004fa85cbb3588c18cc6b83bf3140d8f94c83d11dbca7bd"},"File:6303f205127c3b16d9cf1bdf4617c96109a03c5f2669341fbc0e1d37cd776b29":{"type":"File","value":"6303f205127c3b16d9cf1bdf4617c96109a03c5f2669341fbc0e1d37cd776b29"},"File:6b980cadc3e7047cc51ad1234cb7e76ff520149a746cb64e5631af1ea1939962":{"type":"File","value":"6b980cadc3e7047cc51ad1234cb7e76ff520149a746cb64e5631af1ea1939962"},"File:71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38":{"type":"File","value":"71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38"},"File:7ae79f834a4b875a14d63a0db356eec1d356f8e64ff9964e458d1c2050e5d180":{"type":"File","value":"7ae79f834a4b875a14d63a0db356eec1d356f8e64ff9964e458d1c2050e5d180"},"File:7ec9ee07bfd67150d1bc26158000436b63ca8dbb2623095c049e06091fa374c3":{"type":"File","value":"7ec9ee07bfd67150d1bc26158000436b63ca8dbb2623095c049e06091fa374c3"},"File:825adb4cb11c9cfc85c742fee59361140229f5c1319d4430ad4f24d9c1e76ee8":{"type":"File","value":"825adb4cb11c9cfc85c742fee59361140229f5c1319d4430ad4f24d9c1e76ee8"},"File:9b5a8b323d2d1209a5696eaf521669886f028ce1ecdbb49d1610c09a22746330":{"type":"File","value":"9b5a8b323d2d1209a5696eaf521669886f028ce1ecdbb49d1610c09a22746330"},"File:a87aa800f996902f06c735ea44f4f1e47f03274fe714a193c9e13c5d47230fab":{"type":"File","value":"a87aa800f996902f06c735ea44f4f1e47f03274fe714a193c9e13c5d47230fab"},"File:ac97e5492a3ce1689a2b3c25d588fac68dff5c2b79fcf4067f2d781f092ba2a1":{"type":"File","value":"ac97e5492a3ce1689a2b3c25d588fac68dff5c2b79fcf4067f2d781f092ba2a1"},"File:bab8d388ea3af1aabb61b8884cfaa7276a2bfd77789856dd610480c55e4d0a60":{"type":"File","value":"bab8d388ea3af1aabb61b8884cfaa7276a2bfd77789856dd610480c55e4d0a60"},"File:d2e374df7122c0676b4618aed537dfc8a7b5714b75d362bfbe85b38f47e3d4a4":{"type":"File","value":"d2e374df7122c0676b4618aed537dfc8a7b5714b75d362bfbe85b38f47e3d4a4"},"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a":{"type":"File","value":"dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a"},"File:dfd55d0ddd1a7d081fce8e552dc29706a84dc6ca2fdd2f82d63f33d74e882849":{"type":"File","value":"dfd55d0ddd1a7d081fce8e552dc29706a84dc6ca2fdd2f82d63f33d74e882849"},"File:e0234af5f71592c472439536e710ba8105d62dfa68722965df87fed50bab1816":{"type":"File","value":"e0234af5f71592c472439536e710ba8105d62dfa68722965df87fed50bab1816"},"File:e2175e48a93b2a7fa25acc6879f3676e04a0c11bb8cdfd8d305e35fd9b5bbbb4":{"type":"File","value":"e2175e48a93b2a7fa25acc6879f3676e04a0c11bb8cdfd8d305e35fd9b5bbbb4"},"File:edde733a8d2ca65c8b4865525290e55b703530c954f001e68d1b76b2a54edcb5":{"type":"File","value":"edde733a8d2ca65c8b4865525290e55b703530c954f001e68d1b76b2a54edcb5","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}}},"chains":[{"id":"1555303091838528834","root":"File:edde733a8d2ca65c8b4865525290e55b703530c954f001e68d1b76b2a54edcb5","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"sandbox_files","root":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","edges":[{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:574595b5fd6223e4a004fa85cbb3588c18cc6b83bf3140d8f94c83d11dbca7bd"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:825adb4cb11c9cfc85c742fee59361140229f5c1319d4430ad4f24d9c1e76ee8"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:4e9f3e74e984b1c6e4696717ae36396e7504466419d8e4323af3a89de2e2b784"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:38a75f86db58eb8d2a7c0213861860a64833c78f59eff19141ffd6c3b6e28835"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:7ae79f834a4b875a14d63a0db356eec1d356f8e64ff9964e458d1c2050e5d180"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:9b5a8b323d2d1209a5696eaf521669886f028ce1ecdbb49d1610c09a22746330"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:2581a6bca6f4b307658b24a7584a6b300c91e32f2fe06eb1dca00adce60fa723"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:edde733a8d2ca65c8b4865525290e55b703530c954f001e68d1b76b2a54edcb5"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:6b980cadc3e7047cc51ad1234cb7e76ff520149a746cb64e5631af1ea1939962"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:7ec9ee07bfd67150d1bc26158000436b63ca8dbb2623095c049e06091fa374c3"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:d2e374df7122c0676b4618aed537dfc8a7b5714b75d362bfbe85b38f47e3d4a4"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:a87aa800f996902f06c735ea44f4f1e47f03274fe714a193c9e13c5d47230fab"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:4824a06b819cbe49c485d68a9802d9dae3e3c54d4c2d8b706c8a87b56ceefbf3"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:dfd55d0ddd1a7d081fce8e552dc29706a84dc6ca2fdd2f82d63f33d74e882849"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:0afe688b6fca94c69780f454be65e12d616c6e6376e80c5b3835e3fa6de3eb8a"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:00fb8e819ffdd2c246f0e6c8c3767a08e704812c6443c8d657dfb388aeb27cf9"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:ac97e5492a3ce1689a2b3c25d588fac68dff5c2b79fcf4067f2d781f092ba2a1"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:bab8d388ea3af1aabb61b8884cfaa7276a2bfd77789856dd610480c55e4d0a60"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:e2175e48a93b2a7fa25acc6879f3676e04a0c11bb8cdfd8d305e35fd9b5bbbb4"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:e0234af5f71592c472439536e710ba8105d62dfa68722965df87fed50bab1816"},{"edge_kind":"extracted","from_key":"File:dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","to_key":"File:6303f205127c3b16d9cf1bdf4617c96109a03c5f2669341fbc0e1d37cd776b29"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":78,"dropped_files_count":0,"extracted_files_count":23,"files_written_count":69,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6abeb6d84c92b74ede04cea0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":81,"malware_family":"Trojan.Injuke.gen.idop","submit_name":"1801923906b6afe1dd3f32480f4e29f8.exe","analysis_start_time":"2026-10-01T19:39:06+00:00","indicators_count":{"informative":234,"suspicious":68,"malicious":3},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}],"processes":[{"pid":2948,"ppid":0,"name":"1801923906b6afe1dd3f32480f4e29f8.exe","command_line":"","sha256":"dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a","normalized_path":"C:\\1801923906b6afe1dd3f32480f4e29f8.exe","uid":"00000000-00002948","icon":"$7d"},{"pid":5056,"ppid":2948,"name":"1801923906b6afe1dd3f32480f4e29f8.tmp","command_line":"/SL5=\"$301D8,6977575,54272,C:\\1801923906b6afe1dd3f32480f4e29f8.exe\"","sha256":"7233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49","normalized_path":"%TEMP%\\is-FJQA3.tmp\\1801923906b6afe1dd3f32480f4e29f8.tmp","parent_uid":"00000000-00002948","uid":"00000000-00005056"},{"pid":4204,"ppid":5056,"name":"schtasks.exe","command_line":"/Query","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00005056","uid":"00000000-00004204"},{"pid":2448,"ppid":5056,"name":"crtgame.exe","command_line":"-i","sha256":"825adb4cb11c9cfc85c742fee59361140229f5c1319d4430ad4f24d9c1e76ee8","normalized_path":"%PROGRAMFILES%\\(x86)\\CRTGame\\crtgame.exe","parent_uid":"00000000-00005056","uid":"00000000-00002448"},{"pid":4060,"ppid":2448,"name":"WerFault.exe","command_line":"-u -p 2448 -s 564","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002448","uid":"00000000-00004060"},{"pid":4856,"ppid":2448,"name":"WerFault.exe","command_line":"-u -p 2448 -s 564","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002448","uid":"00000000-00004856"},{"pid":2268,"ppid":5056,"name":"net.exe","command_line":"helpmsg 10","sha256":"08f791037fd70209fd599c4f35088a7332dadfa6be92d073c243c5cc79fefe66","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00000000-00005056","uid":"00000000-00002268"},{"pid":7632,"ppid":2268,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 helpmsg 10","sha256":"524061b58841210842f52b7863e51953fcff343b8c2ff46dfe9c8329bb439d46","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00000000-00002268","uid":"00000000-00007632"},{"pid":2180,"ppid":5056,"name":"crtgame.exe","command_line":"-s","sha256":"825adb4cb11c9cfc85c742fee59361140229f5c1319d4430ad4f24d9c1e76ee8","normalized_path":"%PROGRAMFILES%\\(x86)\\CRTGame\\crtgame.exe","parent_uid":"00000000-00005056","uid":"00000000-00002180"},{"pid":3496,"ppid":2180,"name":"WerFault.exe","command_line":"-u -p 2180 -s 536","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002180","uid":"00000000-00003496"},{"pid":7992,"ppid":2180,"name":"WerFault.exe","command_line":"-u -p 2180 -s 536","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002180","uid":"00000000-00007992"},{"pid":7376,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 2448 -ip 2448","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007376","icon":"$7e"},{"pid":3876,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 2180 -ip 2180","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003876","icon":"$7f"}],"all_imported_dlls":["combase.dll","VxSSL32.dll","cryptsp.dll","_isdecmp.dll","iertutil.dll","samcli.dll","cldapi.dll","ntdll.dll","gdi32full.dll","TextInputFramework.dll","msasn1.dll","sspicli.dll","version.dll","ExplorerFrame.dll","kernel32.dll","apphelp.dll","imm32.dll","ole32.dll","shell32.dll","ntmarta.dll","AppxSip.dll","msvcp_win.dll","msvcrt.dll","vcruntime140.dll","msctf.dll","_iscrypt.dll","aepic.dll","msvcp140.dll","shlwapi.dll","shfolder.dll","sfc.dll","netutils.dll","comctl32.dll","wow64win.dll","user32.dll","rpcrt4.dll","cryptbase.dll","bcryptprimitives.dll","windows.storage.dll","tiptsf.dll","gdi32.dll","sechost.dll","fltLib.dll","SHCore.dll","bcrypt.dll","taskschd.dll","wkscli.dll","wow64.dll","kernel.appcore.dll","profapi.dll","WinTypes.dll","OpcServices.dll","imagehlp.dll","srvcli.dll","dsrole.dll","KernelBase.dll","mpr.dll","ucrtbase.dll","advapi32.dll","dwmapi.dll","urlmon.dll","xmllite.dll","logoncli.dll","CoreUIComponents.dll","sfc_os.dll","comdlg32.dll","IPHLPAPI.DLL","wow64cpu.dll","ws2_32.dll","uxtheme.dll","clbcatq.dll","cfgmgr32.dll","powrprof.dll","CoreMessaging.dll","setupapi.dll","crypt32.dll","win32u.dll","oleaut32.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"is-1782F.tmp","sha256":"574595b5fd6223e4a004fa85cbb3588c18cc6b83bf3140d8f94c83d11dbca7bd","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"crtgame.exe","sha256":"825adb4cb11c9cfc85c742fee59361140229f5c1319d4430ad4f24d9c1e76ee8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-2GT0F.tmp","sha256":"4e9f3e74e984b1c6e4696717ae36396e7504466419d8e4323af3a89de2e2b784","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-99HP5.tmp","sha256":"38a75f86db58eb8d2a7c0213861860a64833c78f59eff19141ffd6c3b6e28835","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-B3Q5N.tmp","sha256":"7ae79f834a4b875a14d63a0db356eec1d356f8e64ff9964e458d1c2050e5d180","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"_iscrypt.dll","sha256":"2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"_isdecmp.dll","sha256":"71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-0JIV2.tmp","sha256":"9b5a8b323d2d1209a5696eaf521669886f028ce1ecdbb49d1610c09a22746330","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-16HGU.tmp","sha256":"2581a6bca6f4b307658b24a7584a6b300c91e32f2fe06eb1dca00adce60fa723","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-176E6.tmp","sha256":"edde733a8d2ca65c8b4865525290e55b703530c954f001e68d1b76b2a54edcb5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-2FR1F.tmp","sha256":"6b980cadc3e7047cc51ad1234cb7e76ff520149a746cb64e5631af1ea1939962","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-5FO09.tmp","sha256":"7ec9ee07bfd67150d1bc26158000436b63ca8dbb2623095c049e06091fa374c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-5V2FQ.tmp","sha256":"d2e374df7122c0676b4618aed537dfc8a7b5714b75d362bfbe85b38f47e3d4a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-6GFSE.tmp","sha256":"a87aa800f996902f06c735ea44f4f1e47f03274fe714a193c9e13c5d47230fab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-7G6C6.tmp","sha256":"4824a06b819cbe49c485d68a9802d9dae3e3c54d4c2d8b706c8a87b56ceefbf3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-ACO5V.tmp","sha256":"dfd55d0ddd1a7d081fce8e552dc29706a84dc6ca2fdd2f82d63f33d74e882849","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-1UES2.tmp","sha256":"0afe688b6fca94c69780f454be65e12d616c6e6376e80c5b3835e3fa6de3eb8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-2DNUI.tmp","sha256":"00fb8e819ffdd2c246f0e6c8c3767a08e704812c6443c8d657dfb388aeb27cf9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-5B1CE.tmp","sha256":"ac97e5492a3ce1689a2b3c25d588fac68dff5c2b79fcf4067f2d781f092ba2a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-5FSBO.tmp","sha256":"bab8d388ea3af1aabb61b8884cfaa7276a2bfd77789856dd610480c55e4d0a60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-741AF.tmp","sha256":"e2175e48a93b2a7fa25acc6879f3676e04a0c11bb8cdfd8d305e35fd9b5bbbb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-75RCA.tmp","sha256":"e0234af5f71592c472439536e710ba8105d62dfa68722965df87fed50bab1816","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"is-7PEIO.tmp","sha256":"6303f205127c3b16d9cf1bdf4617c96109a03c5f2669341fbc0e1d37cd776b29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%TEMP%\\is-FJQA3.tmp\\1801923906b6afe1dd3f32480f4e29f8.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%TEMP%\\is-SKO5G.tmp\\_isetup\\_RegDLL.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%TEMP%\\is-SKO5G.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%TEMP%\\is-SKO5G.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%TEMP%\\is-SKO5G.tmp\\_isetup\\_isdecmp.dll","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%TEMP%\\is-SKO5G.tmp\\_isetup\\_iscrypt.dll","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\uninstall\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\uninstall\\is-1SS2O.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\stuff\\is-698Q8.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\stuff\\is-17E9U.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\stuff\\is-51ERJ.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\stuff\\is-5UJ45.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-5FO09.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-US632.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-OA108.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-JKLUF.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-7PEIO.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-741AF.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-MGSS8.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-EC3TD.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-5B1CE.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-E905S.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-75RCA.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-T8HGN.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-1UES2.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-0JIV2.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-TL616.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-7G6C6.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-OUL4D.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-JL83O.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-TRSVM.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-HGR7I.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-D07S7.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-B3Q5N.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-2GT0F.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-2DNUI.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-176E6.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-CLTQM.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-EJ5GB.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-16HGU.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-99HP5.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-6GFSE.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-RCUG2.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-1782F.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-5V2FQ.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-JL38M.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-SRUKB.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-TH4QT.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-BDUOT.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-I1F17.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-TEH5V.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-ACO5V.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-N4GF7.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-5FSBO.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-R5S1L.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\lessmsi\\is-CKNJD.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-2FR1F.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-B8KI1.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-ND5O5.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-E9RN0.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\plugins\\internal\\is-7VHIE.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\plugins\\internal\\is-9KF1S.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-ILRE8.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-FVU8F.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-O6COR.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\bin\\x86\\is-EVVCU.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\is-M8MSM.tmp","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"path":"%PROGRAMFILES%\\(x86)\\CRTGame\\crtgame.exe","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"SM0:2948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"Local\\SM0:2948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5056:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5056:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5056:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"Local\\SM0:5056:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"SM0:5056:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"SM0:5056:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\AnyMediaPlayer","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2448:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"SM0:2448:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"AnyMediaPlayer","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2180:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]},{"name":"SM0:2180:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abeb6d84c92b74ede04cea0"}]}]}},"report_ids":{"sandbox_job_ids":["6abeb6d84c92b74ede04cea0"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100 Sample dcb2cfd87af6… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample dcb2cfd87af6…. Malware family: Win/malicious_confidence_100. Threat score 81/100. 10/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100 Sample dcb2cfd87af6… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample dcb2cfd87af6…. Malware family: Win/malicious_confidence_100. Threat score 81/100. 10/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dcb2cfd87af6581fe54e37daf742a7828834cf4ca90b37c73dee4f2171dff97a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100 Sample dcb2cfd87af6… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample dcb2cfd87af6…. Malware family: Win/malicious_confidence_100. Threat score 81/100. 10/27 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L80","11",{}]]