34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 58:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T42c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample e4fda2d16d8d… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample e4fda2d16d8d…. Threat score 35/100. 0/26 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730"],"about":{"@type":"SoftwareApplication","name":"Vibe Panel 1.0.0.exe","applicationCategory":["compressed","7zip"],"identifier":"e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T2b46,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileSecurityW"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")37:T8ff,"VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\TXTFILE\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TXTFILE\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\.TXT\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.TXT\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.TXT") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEMFILEASSOCIATIONS\.TXT\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.TXT\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.TXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.TXT") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\TEXT") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEMFILEASSOCIATIONS\TEXT\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\TEXT\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\TXTFILE\CLSID") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\TXTFILE\CLSID") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\*") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\*\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\ALLFILESYSTEMOBJECTS\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\ALLFILESYSTEMOBJECTS\SHELLEX\PROPERTYHANDLER") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\.HTML") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.HTML") "VibePanel1.0.0.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\.HTML")38:Ta46,"VibePanel1.0.0.exe" queried SystemProcessInformation at 00000000-00005220-00000C15-1611752366 [PID: 5220] "VibePanel1.0.0.exe" queried SystemProcessInformation at 00000000-00005220-00000C15-1611759082 [PID: 5220] "VibePanel1.0.0.exe" queried SystemProcessInformation at 00000000-00005220-00000C15-1611915867 [PID: 5220] "VibePanel1.0.0.exe" queried SystemProcessInformation at 00000000-00005220-00000C15-1611922614 [PID: 5220] "VibePanel1.0.0.exe" queried SystemProcessInformation at 00000000-00005220-00000C15-1612121332 [PID: 5220] "VibePanel1.0.0.exe" queried SystemProcessInformation at 00000000-00005220-00000C15-1612128220 [PID: 5220] "VibePanel1.0.0.exe" queried SystemProcessInformation at 00000000-00005220-00000C15-1626336878 [PID: 5220] "VibePanel1.0.0.exe" queried SystemProcessInformation at 00000000-00005220-00000C15-1626343906 [PID: 5220] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1632814573 [PID: 6528] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1632821514 [PID: 6528] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1632996267 [PID: 6528] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1633005690 [PID: 6528] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1633152939 [PID: 6528] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1633162041 [PID: 6528] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1633523086 [PID: 6528] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1633530124 [PID: 6528] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1633739645 [PID: 6528] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1633746413 [PID: 6528] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1634739164 [PID: 6528] "Vibe Panel.exe" queried SystemProcessInformation at 00000000-00006528-00000C15-1634745681 [PID: 6528] "powershell.exe" queried SystemProcessInformation at 00000000-00005168-00000C15-1635518575 [PID: 5168] "powershell.exe" queried SystemProcessInformation at 00000000-00005168-00000C15-1635526233 [PID: 5168] "powershell.exe" queried SystemProcessInformation at 00000000-00005168-00000C15-1635807852 [PID: 5168] "powershell.exe" queried SystemProcessInformation at 00000000-00005168-00000C15-1635814827 [PID: 5168] "powershell.exe" queried SystemProcessInformation at 00000000-00005168-00000C15-1639020991 [PID: 5168]39:T4821,Found XOR loop in file "libGLESv2.dll" at offset 1696586; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 1698183; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2132803; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2258079; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2259343; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2260447; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2261551; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2262655; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2264991; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2276191; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2277727; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2950172; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 4045808; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2801037; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 2802727; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 2845635; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 2846207; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 2904815; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 3623472; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 3651898; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 3663611; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 5160268; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 5218556; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 266419; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 386382; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 404359; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 463621; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 528034; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 559893; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 559942; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 673907; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 752635; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 759177; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 759338; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 767476; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 767644; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 789068; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 789222; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 864216; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1714272; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1795380; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1911498; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1911929; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1914613; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1933797; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1982474; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2068786; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2244522; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2347339; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2347369; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2355273; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2389050; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2771944; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2772327; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2800481; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2801745; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2801859; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2802193; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2802449; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3494812; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3602050; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3735733; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736601; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736628; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736658; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736688; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736718; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736748; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736778; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736808; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736838; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736868; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736898; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736928; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736958; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3736988; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3737018; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3737048; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3763888; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3774184; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3774393; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797234; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797265; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797299; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797333; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797367; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797401; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797435; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797469; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797503; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797537; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797571; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797605; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797639; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797673; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797707; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3797741; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3798763; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3798794; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3798828; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3798862; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3798896; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3798930; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3798964; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3798998; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3799032; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3799066; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3799100; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3799134; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3799168; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3799202; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3799236; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3799270; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3804061; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3824987; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825014; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825044; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825074; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825104; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825134; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825164; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825194; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825224; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825254; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825284; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825314; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825344; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825374; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825404; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3825434; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836077; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836584; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836611; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836641; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836671; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836701; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836731; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836761; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836791; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836821; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836851; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836881; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836911; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836941; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3836971; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3837001; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3837031; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3838782; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3881981; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3882307; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4269097; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4271387; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4329180; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4329546; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4329718; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4330905; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4337063; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4347981; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4427377; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4502307; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4675494; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4824988; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4825080; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4908006; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 5039868; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1931884; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2802967; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2859684; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2863488; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 623536; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 771268; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 801375; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1011734; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1071274; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1077622; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1080099; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1111167; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1111268; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1111346; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1637332; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1658132; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1661828; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1665524; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1683774; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2102439; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2106446; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 2897848; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 19447; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 19696; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 39447; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 39696; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 59591; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 59816; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 78311; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 78536; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 97303; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 97528; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 116023; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 116248; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 580854; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 580949; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 580999; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 964233; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1440920; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1653251; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1655388; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 1655443; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2206766; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2398051; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2805671; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2879940; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2892588; code bytes = 8030 Found XOR loop in file "libEGL.dll" at offset 374832; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 441220; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 125760; code bytes = 33c1 Found XOR loop in file "libEGL.dll" at offset 277207; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 377388; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 423495; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 429493; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 430733; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 432095; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 433473; code bytes = 30d0 Found XOR loop in file "nsis7z.dll" at offset 14196; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32458; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32489; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 32520; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 39010; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 66588; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 118788; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 266651; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 274623; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 274752; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 417293; code bytes = 33c1 Found XOR loop in file "nsis7z.dll" at offset 16577; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 423456; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 424610; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 427782; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 428606; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 429474; code bytes = 8030 Found XOR loop in file "nsis7z.dll" at offset 430714; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 104839; code bytes = 30d0 Found XOR loop in file "elevate.exe" at offset 9341; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 38220; code bytes = 8030 Found XOR loop in file "elevate.exe" at offset 38617; code bytes = 80303a:T2f58,"VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000c67636325903fefffffff4f419000200000080bea076609ef674e4f4190091bea076020000000000000030f519003b3cc3760200000000000000f447f674000000009d1ac376841ac376ee178f75f447f67405000000609ef67400000000ddaff7749c48fa74a8f51900d01fc676762d5903feffffff3cf51900101ac37640f3f7744cf5190068caf774e044fa7440f3f77458f5190082caf77440f3f77478f519006a9ef67440f3f77447acc276010000000100000001000000f9c9f774b8f51900f0c0f77400000000b4c0f77478318438010000000100000000000000000000000000000088f5190056256377f8f5190020c3f77410d3674cfeffffff (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000080375d0001000000e4d91900a10063777000637720e80d666453ae76160163773f00000041000000505d5d00c85d5d0000000000b47b947600000000d017ab76b4d7190000005d007f00000004000000000000006453ae76000000006453ae7601000000f0e0a474cc97ac76f0e0a47490c55e0000000000b0d71900f0e0a474c0005d009c025d001001000070025d00000000000000000004d8190093c5a374f4cd5f0032eb90830000000050c5a37409c6a374f8cd5f00020000000000000000000000987880574f8c6244bb6371042380b109000000000058a8742c7b8e7400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000080375d0001000000e4d91900a10063777000637720e80d666453ae76160163773f00000041000000505d5d00c85d5d0000000000b47b947600000000d017ab76b4d7190000005d007f00000004000000000000006453ae76000000006453ae7601000000f0e0a474cc97ac76f0e0a47490c55e0000000000b0d71900f0e0a474c0005d009c025d001001000070025d00000000000000000004d8190093c5a3741cb75f0032eb90830000000050c5a37409c6a37420b75f00020000000000000000000000987880574f8c6244bb6371042380b109000000000058a8742c7b8e7400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000080375d0001000000e4d91900a10063777000637720e80d666453ae76160163773f00000041000000505d5d00c85d5d0000000000b47b947600000000d017ab76b4d7190000005d007f00000004000000000000006453ae76000000006453ae7601000000f0e0a474cc97ac76f0e0a47490c55e0000000000b0d71900f0e0a474c0005d009c025d001001000070025d00000000000000000004d8190093c5a374ec48600032eb90830000000050c5a37409c6a374f0486000020000000000000000000000987880574f8c6244bb6371042380b109000000000058a8742c7b8e7400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000080375d0001000000e4d91900a10063777000637720e80d666453ae76160163773f00000041000000505d5d00c85d5d0000000000b47b947600000000d017ab76b4d7190000005d007f00000004000000000000006453ae76000000006453ae7601000000f0e0a474cc97ac76f0e0a47490c55e0000000000b0d71900f0e0a474c0005d009c025d001001000070025d00000000000000000004d8190093c5a3741c51600032eb90830000000050c5a37409c6a37420516000020000000000000000000000987880574f8c6244bb6371042380b109000000000058a8742c7b8e7400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000080375d0001000000e4d91900a10063777000637720e80d666453ae76160163773f00000041000000505d5d00c85d5d0000000000b47b947600000000d017ab76b4d7190000005d007f00000004000000000000006453ae76000000006453ae7601000000f0e0a474cc97ac76f0e0a47490c55e0000000000b0d71900f0e0a474c0005d009c025d001001000070025d00000000000000000004d8190093c5a3744c5d600032eb90830000000050c5a37409c6a374505d6000020000000000000000000000987880574f8c6244bb6371042380b109000000000058a8742c7b8e7400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000080375d0001000000e4d91900a10063777000637720e80d666453ae76160163773f00000041000000505d5d00c85d5d0000000000b47b947600000000d017ab76b4d7190000005d007f00000004000000000000006453ae76000000006453ae7601000000f0e0a474cc97ac76f0e0a47490c55e0000000000b0d71900f0e0a474c0005d009c025d001001000070025d00000000000000000004d8190093c5a3747c69600032eb90830000000050c5a37409c6a37480696000020000000000000000000000987880574f8c6244bb6371042380b109000000000058a8742c7b8e7400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000080375d0001000000e4d91900a10063777000637720e80d666453ae76160163773f00000041000000505d5d00c85d5d0000000000b47b947600000000d017ab76b4d7190000005d007f00000004000000000000006453ae76000000006453ae7601000000f0e0a474cc97ac76f0e0a47490c55e0000000000b0d71900f0e0a474c0005d009c025d001001000070025d00000000000000000004d8190093c5a374d484600032eb90830000000050c5a37409c6a374d8846000020000000000000000000000987880574f8c6244bb6371042380b109000000000058a8742c7b8e7400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a0000020000000000190070b5657748f27a11feffffff30f4190000000000c8dd1b0290e57474f4021b0200f419000000000000001b0200f41900a0e57474e4dd1b0201cc747448ee5e00c8dd1b0214f41900f4f3190090e57474c8dd1b020000000010000000e86763750000000080f4190080f41900a0e57474e4dd1b02f3aa7474c0dd1b020240008003ab747400000000c0dd1b0200000000b0e5747448ee5e00000000000000000050f41900fcc50d669800000050f4190038216477e4dd1b02000000000000000048ee5e0004000000c0dd1b0270dd1b02c1636b75dd3780570000000048ee5e00c0dd1b0248ee5e0048ee5e00e867637564f41900a0f41900a0f51900 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000654a00000200000000000000e4f31900c5906b74409c6d7420f419009f736b74020000008f736b74dccef34a1400000058226c741500000000000000f4f31900b9b06377c0f41900302b6b74f40e873efeffffff8f736b7466766b743cf4190034f4190040f4190050f4190054f4190002000000020000002ee8677458f41900d9756b7400996d74f21c6c7464f41900ca156b74f21c6c7470f41900ee156b74f21c6c7490f419000e116774f21c6c7409786b740100000001000000010000006b156b74d0f419004b176b740000000001176b742ccef34a0100000001000000000000000000000000000000a0f419005625637710f51900302b6b74640a873efeffffffe0f41900 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000190045db627780e41900000000001403000050f3190090e41900842d1a0000d028000000290000000000180000000000000000000000040000009cd50d660100000000001900b9b06377b7e7c29838e41900feffffff64e41900528e657707000000b0e4190089e99f76f2e419005c000000f2e4190000000000ece4190000000000c24afd020000000000000000050000000000000002000000d04afd02c04afd02fce41900020000000a000000d04afd02f8e6190005e79f76ece4190000000000c04afd020a00000020e79f76c04afd02789dc1c744e9190034ee190000121b020101000000000000ece4190043003a005c0055007300650072007300 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000190000005d0028e319004ce319009032a57460082b03640000000000000050925d00180000000000000016001f0090c05e0040d15e0040925d0000005d0064082b0368e3190000006277000000000000000000000000102a6000e0a6707580e31900002c6a7500005d000000000040d15e00000000009cea1900aa7caf748f35ad74aad9908300000000ecf01900c4f093742c7b8e7400000000000000000000000000000000ffffffff0000000000000000000000000000000000000000102a6000242a6000102a600000000000000000000000000000000000000000001c0100000a0000000000000000121b02050000000000190045db627780e41900 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000064e41900528e657707000000b0e4190089e99f76f2e419005c000000f2e4190000000000ece4190000000000424cfd020000000000000000050000000000000002000000504cfd02404cfd02fce41900020000000a000000504cfd02f8e6190005e79f76ece4190000000000404cfd020a00000020e79f76404cfd02c87c60000100000034ee1900050000000101000000000000ece4190043003a005c0055007300650072007300 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000190000005d0028e319004ce319009032a57450052b03640000000000000050925d00040000000000000016000d0090c05e0080c35e0040925d0000005d0054052b0368e3190000006277000000000000000000000000e0376000e0a6707580e31900002c6a7500005d000000000080c35e00000000009cea1900aa7caf748f35ad74aad9908300000000ecf01900c4f093742c7b8e7400000000000000000000000000000000ffffffff0000000000000000000000000000000000000000e0376000f4376000e037600000000000000000000000000000000000000000001c0100000a0000000000000000121b0205000000000000000000000000000000 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000ffff44e519001d8266770000000044826677980ecc0700005d001900020000000000f87e5f00070000000000000003000700e0386000103e6000e87e5f0000005d000000000048e51900f63e6277980ecc07000000004ce51900528e65770700000098e5190089e99f76dae519005c000000dae5190000000000d4e51900000000005a82080400000000000000000500000000000000020000006882080458820804e4e51900020000000a00000068820804e0e7190005e79f76d4e5190000000000588208040a00000020e79f7658820804a8ea1900010000001cef1900050000000101000000000000d4e5190043003a005c0055007300650072007300 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000000002000002a050cc0700f1086b00005d001a53627700000000001003043d1f02000000000018010000880fffffb0e21900f64a6277e89d00001a53627748d30d66a050cc0700005d0000000000ff3f00006f4effff0810030400005d0018010000880fffff6a010000786e5d005c605d0068010000e75d00bafbffffffff07000000005d0000000207ff0700005000000000005d00ff070000f4e1190093c5a3742cb30404c2d290830000000050c5a37409c6a37430b30404020000000000000000000000987880574f8c6244bb6371042380b109000000000058a8742c7b8e7400000000000000000000000000000000ffffffff0000000000000000 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000654a0000020000000000190000005d0010e4190034e419009032a57478b7040464000000000000007858cb0720000000000000001d00220090eecb07c004cc076858cb0700005d007cb7040450e419000000627700000000000000000000000090250604e0a6707568e41900002c6a7500005d0000000000c004cc070000000084eb1900aa7caf748f35ad74b2d8908300000000d4f11900c4f093742c7b8e7400000000000000000000000000000000ffffffff000000000000000000000000000000000000000090250604a42506049025060400000000000000000000000000000000000006040000000000121b0205000000654a0000020000000000ffff44e519001d826677 (UID: 00000000-00005220)3b:T862,"Vibe Panel.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\resources\app\package.json" at 00000000-00006528-00000C17-1634321203 "Vibe Panel.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006528-00000C17-1634327388 "Vibe Panel.exe" queries volume information of "C:\Users" at 00000000-00006528-00000C17-1634327794 "Vibe Panel.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00006528-00000C17-1634328162 "Vibe Panel.exe" queries volume information of "C:\Users\%OSUSER%\AppData" at 00000000-00006528-00000C17-1634328401 "Vibe Panel.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00006528-00000C17-1634328632 "Vibe Panel.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp" at 00000000-00006528-00000C17-1634328906 "Vibe Panel.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ" at 00000000-00006528-00000C17-1634329320 "Vibe Panel.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\resources" at 00000000-00006528-00000C17-1634329715 "Vibe Panel.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\resources\app" at 00000000-00006528-00000C17-1634330162 "Vibe Panel.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\resources\app\package.json" at 00000000-00006528-00000C17-1634330811 "Vibe Panel.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\resources\app\main.js" at 00000000-00006528-00000C17-1634349596 "Vibe Panel.exe" queries volume information of an entire harddrive"C:\" at 00000000-00006528-00000C17-1634350028 "Vibe Panel.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\resources\app\main.js" at 00000000-00006528-00000C17-1634350688 "Vibe Panel.exe" queries volume information of "C:\Windows\System32\drivers\etc\hosts" at 00000000-00006528-00000C17-16346993563c:T27e3,"VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %TEMP%\nsjB68.tmp\System.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %TEMP%\nsjB68.tmp\nsis7z.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "LoadLibrary" with a parameter %TEMP%\nsjB68.tmp\StdUtils.dll (UID: 00000000-00005220) "Vibe Panel.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter api-ms-win-shcore-scaling-l1-1-1.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter COMCTL32.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00006528) "Vibe Panel.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006528) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\704b6614c4744d16332d08daf175deed\Microsoft.PowerShell.ConsoleH (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\481f1a5c0959042363de5c765867b51d\System.Management.Automation. (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005168) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005168)3d:T7ea6,"VibePanel1.0.0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter Call (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter GetVersionEx (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter GetVersionExW (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter Free (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter Int64Op (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter FindFirstStreamW (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter FindNextStreamW (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter Extract (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "GetProcAddress" with a parameter GetAllParameters (UID: 00000000-00005220) "Vibe Panel.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RtlCaptureStackBackTrace (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter NtSetInformationFile (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter NtQueryVolumeInformationFile (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter NtQueryDirectoryFile (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SetWinEventHook (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetHostNameW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetSecurityInfo (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter IsValidSecurityDescriptor (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorControl (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorOwner (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorGroup (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorDacl (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetSecurityDescriptorSacl (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter IsValidAcl (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetAce (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SetSecurityInfo (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetHandleVerifier (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter LdrLockLoaderLock (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter LdrUnlockLoaderLock (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CreateWindowStationW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetThreadDesktop (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter IsValidSid (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter BuildTrusteeWithSidW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SetProcessWindowStation (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CreateDesktopW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RegisterClassExW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetThreadDescription (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RegisterSuspendResumeNotification (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SetProcessDpiAwarenessContext (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SetProcessDpiAwareness (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter VirtualAlloc2 (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter MapViewOfFile3 (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter UnmapViewOfFile2 (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RtlAddGrowableFunctionTable (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RtlDeleteGrowableFunctionTable (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CharUpperW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetPointerDevices (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetDisplayConfigBufferSizes (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter QueryDisplayConfig (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter DisplayConfigGetDeviceInfo (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter NtQuerySection (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetICMProfileW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RegisterDeviceNotificationW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RegisterHotKey (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetNamedSecurityInfoW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter SetNamedSecurityInfoW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter LoadIconW (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter GetQueueStatus (UID: 00000000-00006528) "Vibe Panel.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00006528) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00005168) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005168)3e:T988,Process VibePanel1.0.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5220:168:WilStaging_02" Process VibePanel1.0.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5220:168:WilStaging_02" Process VibePanel1.0.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5220:64:WilError_03" Process VibePanel1.0.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5220:64:WilError_03" Process VibePanel1.0.0.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process VibePanel1.0.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process VibePanel1.0.0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process VibePanel1.0.0.exe created mutex with name "Local\SM0:5220:168:WilStaging_02" Process VibePanel1.0.0.exe created mutex with name "Local\SM0:5220:64:WilError_03" Process VibePanel1.0.0.exe created mutex with name "SM0:5220:64:WilError_03" Process VibePanel1.0.0.exe created mutex with name "SM0:5220:168:WilStaging_02" Process VibePanel1.0.0.exe created mutex with name "Local\ZonesCacheCounterMutex" Process VibePanel1.0.0.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process Vibe Panel.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6528:304:WilStaging_02" Process Vibe Panel.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6528:304:WilStaging_02" Process Vibe Panel.exe created mutex with name "\Sessions\1\BaseNamedObjects\vibe-panelProcessSingletonStartup" Process Vibe Panel.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6528:120:WilError_03" Process Vibe Panel.exe created mutex with name "Local\SM0:6528:304:WilStaging_02" Process Vibe Panel.exe created mutex with name "SM0:6528:120:WilError_03" Process Vibe Panel.exe created mutex with name "vibe-panelProcessSingletonStartup" Process Vibe Panel.exe created mutex with name "SM0:6528:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5168:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5168:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5168:120:WilError_03" Process powershell.exe created mutex with name "SM0:5168:120:WilError_03"3f:T620,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]40:T2371,"VibePanel1.0.0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 75220000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 751a0000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 75170000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 75c30000 "VibePanel1.0.0.exe" loaded module "NTDLL.DLL" at base 775e0000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 750c0000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 75000000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 74fd0000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 74fc0000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 74f60000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 75af0000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 74f30000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74f20000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 74f10000 "VibePanel1.0.0.exe" loaded module "KERNEL32.DLL" at base 76ed0000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 74880000 "VibePanel1.0.0.exe" loaded module "%TEMP%\NSJB68.TMP\SYSTEM.DLL" at base 746f0000 "VibePanel1.0.0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 768e0000 "VibePanel1.0.0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 768e0000 "VibePanel1.0.0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 768e0000 "VibePanel1.0.0.exe" loaded module "KERNEL32" at base 76ed0000 "VibePanel1.0.0.exe" loaded module "%TEMP%\NSJB68.TMP\NSIS7Z.DLL" at base 74670000 "VibePanel1.0.0.exe" loaded module "RPCRT4.DLL" at base 75b70000 "VibePanel1.0.0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74f00000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 748e0000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 74650000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.FILEEXPLORER.COMMON.DLL" at base 74600000 "VibePanel1.0.0.exe" loaded module "USER32.DLL" at base 761a0000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 741e0000 "VibePanel1.0.0.exe" loaded module "SSPICLI.DLL" at base 741b0000 "VibePanel1.0.0.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 768e0000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76fc0000 "VibePanel1.0.0.exe" loaded module "%WINDIR%\SYSTEM32\NTSHRUI.DLL" at base 74150000 "VibePanel1.0.0.exe" loaded module "%TEMP%\NSJB68.TMP\STDUTILS.DLL" at base 74130000 "Vibe Panel.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffff1100000 "Vibe Panel.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff81be10000 "Vibe Panel.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff81be10000 "Vibe Panel.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff81bb00000 "Vibe Panel.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff81be10000 "Vibe Panel.exe" loaded module "KERNEL32" at base 7ff81d610000 "Vibe Panel.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ff81be10000 "Vibe Panel.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ff81be10000 "Vibe Panel.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ff81be10000 "Vibe Panel.exe" loaded module "POWRPROF.DLL" at base 7ff81b900000 "Vibe Panel.exe" loaded module "USER32.DLL" at base 7ff81dae0000 "Vibe Panel.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff819380000 "Vibe Panel.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff81b0d0000 "Vibe Panel.exe" loaded module "SHELL32.DLL" at base 7ff81c770000 "Vibe Panel.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7ff81c6b0000 "Vibe Panel.exe" loaded module "ADVAPI32.DLL" at base 7ff81c4c0000 "Vibe Panel.exe" loaded module "KBDUS.DLL" at base 7ff803f90000 "Vibe Panel.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff81df20000 "Vibe Panel.exe" loaded module "API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL" at base 7ff81c6b0000 "Vibe Panel.exe" loaded module "OLE32.DLL" at base 7ff81c580000 "Vibe Panel.exe" loaded module "KERNEL32.DLL" at base 7ff81d610000 "Vibe Panel.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff8198b0000 "Vibe Panel.exe" loaded module "NTDLL.DLL" at base 7ff81e390000 "Vibe Panel.exe" loaded module "COMCTL32.DLL" at base 7ff806c60000 "Vibe Panel.exe" loaded module "RPCRT4.DLL" at base 7ff81d350000 "Vibe Panel.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ff816520000 "Vibe Panel.exe" loaded module "GDI32.DLL" at base 7ff81d470000 "Vibe Panel.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff81d8d0000 "Vibe Panel.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ff81c580000 "Vibe Panel.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff81df20000 "Vibe Panel.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7ff80b8f0000 "Vibe Panel.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ff814430000 "Vibe Panel.exe" loaded module "WTSAPI32.DLL" at base 7ff815800000 "Vibe Panel.exe" loaded module "MSCMS.DLL" at base 7ff815970000 "Vibe Panel.exe" loaded module "CFGMGR32.DLL" at base 2c280740000 "Vibe Panel.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ff80fcb0000 "Vibe Panel.exe" loaded module "DWMAPI.DLL" at base 7ff8194b0000 "Vibe Panel.exe" loaded module "%WINDIR%\SYSTEM32\INPUTHOST.DLL" at base 7ff80b790000 "Vibe Panel.exe" loaded module "%WINDIR%\SYSTEM32\MSSPELLCHECKINGFACILITY.DLL" at base 7ffff0f10000 "Vibe Panel.exe" loaded module "SHLWAPI.DLL" at base 7ff81da80000 "Vibe Panel.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 7ff814f10000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffff1100000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ff81d610000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ff81c4c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff81be10000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff81be10000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff81be10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffff0cd0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ff81da80000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ff8198b0000 "powershell.exe" loaded module "VERSION.DLL" at base 7ff812560000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7fffeb210000 "powershell.exe" loaded module "USER32.DLL" at base 7ff81dae0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ff81be10000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffff18c0000 "powershell.exe" loaded module "NTDLL" at base 7ff81e390000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ff81df20000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ff81d710000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\6078762B90671C2FF9BA39318E2176D8\MSCORLIB.NI.DLL" at base 7fffe9bb0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ff81d350000 "powershell.exe" loaded module "OLE32.DLL" at base 7ff81c580000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ff81df20000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ff81d540000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\FE3C9CF707273488C6C658D52D624640\SYSTEM.NI.DLL" at base 7fffe8970000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\21FF4BA4607B18A9B179AB90FD3B0BC1\SYSTEM.CORE.NI.DLL" at base 7fffe7ef0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\704B6614C4744D16332D08DAF175DEED\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7fffed7a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff81a9f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff81bb00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\481F1A5C0959042363DE5C765867B51D\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7fffe5c00000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ff81df20000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff81df20000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ff81e390000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ff81c77000041:Tbfa,"VibePanel1.0.0.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "VibePanel1.0.0.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "VibePanel1.0.0.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "VibePanel1.0.0.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "VibePanel1.0.0.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "VibePanel1.0.0.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "VibePanel1.0.0.exe" touched "URL Zone Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D95-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "VibePanel1.0.0.exe" touched "PersistentZoneIdentifier" (Path: "HKCU\WOW6432NODE\CLSID\{0968E258-16C7-4DBA-AA86-462DD61E31A3}\TREATAS") "VibePanel1.0.0.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "VibePanel1.0.0.exe" touched "Shell Copy Hook" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\INPROCSERVER32") "VibePanel1.0.0.exe" touched "Shell extensions for sharing" (Path: "HKCU\WOW6432NODE\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\INSTANCE") "VibePanel1.0.0.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "VibePanel1.0.0.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "VibePanel1.0.0.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "VibePanel1.0.0.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "VibePanel1.0.0.exe" touched "Search Gatherer Notification" (Path: "HKCU\WOW6432NODE\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "Vibe Panel.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}") "Vibe Panel.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "Vibe Panel.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "Vibe Panel.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "Vibe Panel.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\TREATAS") "Vibe Panel.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS") "Vibe Panel.exe" touched "Microsoft Spell Checker Factory Class" (Path: "HKCU\CLSID\{7AB36653-1796-484B-BDFA-E74F1DB7C1DC}\TREATAS")42:Td84,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00005220-00000C2B-1612030343] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00005220-00000C2B-1612055129] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00005220-00000C2B-1612096886] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00005220-00000C2B-1612547632] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00005220-00000C2B-1612580026] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00005220-00000C2B-1612609393] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00005220-00000C2B-1612633592] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00005220-00000C2B-1612664567] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00005220-00000C2B-1612690238] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00005220-00000C2B-1612718232] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00005220-00000C2B-1612742934] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00005220-00000C2B-1612768943] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005168-00000C2E-1224623026] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005168-00000C2B-1636611570] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005168-00000C2B-1636829719] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005168-00000C2B-1636907315] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\6078762b90671c2ff9ba39318e2176d8\mscorlib.ni.dll" [Source: 00000000-00005168-00000C2B-1637223051] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005168-00000C2B-1637280105] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005168-00000C2B-1637362912] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00005168-00000C2B-1637483711] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\fe3c9cf707273488c6c658d52d624640\System.ni.dll" [Source: 00000000-00005168-00000C2B-1637637352] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\21ff4ba4607b18a9b179ab90fd3b0bc1\System.Core.ni.dll" [Source: 00000000-00005168-00000C2B-1637820748] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00005168-00000C2B-1637960713] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00005168-00000C2B-1638117722] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00005168-00000C2B-1638420378]43:T144a,"libGLESv2.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsjB68.tmp\7z-out\libGLESv2.dll]- [targetUID: 00000000-00005220] "ffmpeg.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections"- Location: [%TEMP%\nsjB68.tmp\7z-out\ffmpeg.dll]- [targetUID: 00000000-00006528] "libEGL.dll" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections"- Location: [%TEMP%\nsjB68.tmp\7z-out\libEGL.dll]- [targetUID: 00000000-00005220] "nsis7z.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\nsjB68.tmp\nsis7z.dll]- [targetUID: 00000000-00005220] "elevate.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections"- Location: [%TEMP%\nsjB68.tmp\7z-out\resources\elevate.exe]- [targetUID: 00000000-00005220] "System.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsjB68.tmp\System.dll]- [targetUID: 00000000-00005220] "icudtl.dat" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\icudtl.dat]- [targetUID: 00000000-00006528] "app-64.7z" has type "7-zip archive data version 0.4"- Location: [%TEMP%\nsjB68.tmp\app-64.7z]- [targetUID: 00000000-00005220] "LICENSES.chromium.html" has type "HTML document text HTML document ASCII text"- Location: [%TEMP%\nsjB68.tmp\7z-out\LICENSES.chromium.html]- [targetUID: 00000000-00005220] "kn.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\kn.pak]- [targetUID: 00000000-00005220] "hi.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\hi.pak]- [targetUID: 00000000-00005220] "bn.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\bn.pak]- [targetUID: 00000000-00005220] "gu.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\gu.pak]- [targetUID: 00000000-00005220] "el.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\el.pak]- [targetUID: 00000000-00005220] "bg.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\bg.pak]- [targetUID: 00000000-00005220] "ar.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\ar.pak]- [targetUID: 00000000-00005220] "fa.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\fa.pak]- [targetUID: 00000000-00005220] "am.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\am.pak]- [targetUID: 00000000-00005220] "he.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\he.pak]- [targetUID: 00000000-00005220] "ja.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\ja.pak]- [targetUID: 00000000-00005220] "hu.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\hu.pak]- [targetUID: 00000000-00005220] "fr.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\fr.pak]- [targetUID: 00000000-00005220] "fil.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\fil.pak]- [targetUID: 00000000-00005220] "cs.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\cs.pak]- [targetUID: 00000000-00005220] "ko.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\ko.pak]- [targetUID: 00000000-00005220] "ca.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\ca.pak]- [targetUID: 00000000-00005220] "de.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\de.pak]- [targetUID: 00000000-00005220] "hr.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\hr.pak]- [targetUID: 00000000-00005220] "es-419.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\es-419.pak]- [targetUID: 00000000-00005220] "es.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\es.pak]- [targetUID: 00000000-00005220] "it.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\it.pak]- [targetUID: 00000000-00005220] "da.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\da.pak]- [targetUID: 00000000-00005220] "fi.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\fi.pak]- [targetUID: 00000000-00005220] "et.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\et.pak]- [targetUID: 00000000-00005220] "af.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\af.pak]- [targetUID: 00000000-00005220] "id.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\id.pak]- [targetUID: 00000000-00005220] "en-US.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\en-US.pak]- [targetUID: 00000000-00006528] "en-GB.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\en-GB.pak]- [targetUID: 00000000-00005220] "lt.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\locales\lt.pak]- [targetUID: 00000000-00005220] "chrome_200_percent.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\chrome_200_percent.pak]- [targetUID: 00000000-00006528] "chrome_100_percent.pak" has type "data"- Location: [%TEMP%\nsjB68.tmp\7z-out\chrome_100_percent.pak]- [targetUID: 00000000-00006528] "LICENSE.electron.txt" has type "ASCII text"- Location: [%TEMP%\nsjB68.tmp\7z-out\LICENSE.electron.txt]- [targetUID: 00000000-00005220]44:Ta7a,"VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")45:Tff6,"VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINBROKERFORMEDIUMILCONTAINER"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "")46:T584,"VibePanel1.0.0.exe" trying to access non-existent file "C:\Windows\System32\wow64log.dll" "VibePanel1.0.0.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "VibePanel1.0.0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "VibePanel1.0.0.exe" trying to access non-existent file "C:\MSVCP140.dll" "VibePanel1.0.0.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "VibePanel1.0.0.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "VibePanel1.0.0.exe" trying to access non-existent file "C:\Windows\SysWOW64\rpcss.dll" "VibePanel1.0.0.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "VibePanel1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\System.dll" "VibePanel1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\nsis7z.dll" "VibePanel1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\StdUtils.dll" "VibePanel1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\Vibe.exe" "Vibe Panel.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\dbghelp.dll" "Vibe Panel.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\WINMM.dll"47:T4fd,"VibePanel1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ" "VibePanel1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\app-64.7z" "VibePanel1.0.0.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\PROPSYS.dll.mui" "VibePanel1.0.0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\Vibe" "Vibe Panel.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\WINSPOOL.DRV" "Vibe Panel.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\3Lhs95VwVDmnypCbYl7p0o9fgvJ\resources\app.asar" "Vibe Panel.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\vibe-panel" "Vibe Panel.exe" trying to access non-existent file "C:\Users\1DSFVse\AppData\Roaming\vibe-panel" "Vibe Panel.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\vibe-panel\Local State" "Vibe Panel.exe" trying to access non-existent file "C:\Users\1DSFVse\AppData\Roaming\vibe-panel\Local State" "Vibe Panel.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}"48:T8f1,Found reference to API "GetHostNameW" (Indicator: "gethostname"; Source: "00000000-00006528-00000C2C-1633613354") Found reference to API "Cannot copy a socket file" (Indicator: " socket "; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.0047C000.00000004.mdmp") Found reference to API ":authority header is required for CONNECT requests" (Indicator: " connect "; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.0047C000.00000004.mdmp") Found reference to API "The :path header is forbidden for CONNECT requests" (Indicator: " connect "; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.0047C000.00000004.mdmp") Found reference to API "The :scheme header is forbidden for CONNECT requests" (Indicator: " connect "; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.0047C000.00000004.mdmp") Found reference to API "The socket is already bound to an Http2Session" (Indicator: " socket "; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.0047C000.00000004.mdmp") Found reference to API "The socket has been disconnected from the Http2Session" (Indicator: " socket "; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.0047C000.00000004.mdmp") Found reference to API "Changing the socket encoding is not allowed per RFC7230 Section 3." (Indicator: " socket "; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.0047C000.00000004.mdmp") Found reference to API "Bad socket type specified. Valid types are: udp4, udp6" (Indicator: " socket "; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.0047C000.00000004.mdmp") Found reference to API "TLS socket connection must be securely established" (Indicator: " socket "; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.0047C000.00000004.mdmp") Found reference to API "getHostname" (Indicator: "gethostname"; Source: "00000000-00006528.00000000.169509.001C8000.00000004.mdmp")49:T1b81,Found URL "https://chrome.google.com/webstore/category/extensions" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://www.example.com.url" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://www.google.com/chrome/privacy/eula_text.html(&e).$1" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://chromeenterprise.google/policies/" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "http://," - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://passwords.google.comgoogle" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://chrome.google.com/webstore?hl=ko&category=theme81https://myactivity.google.com/myactivity/?utm_source=chrome_nhttps://myactivity.google.com/myactivity/?utm_source=chrome_h-p" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://chromestatus.com/features" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "http://example.com" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://example.com)." - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "http://.

" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "http://:" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "http://example.com)." - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://support.google.com/chrome/answer/6098869" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://chrome.google.com/webstore?hl=ltctrl$1" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://," - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://myactivity.google.com/" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://policies.google.com/" - Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found URL "https://clients2.google.com/service/update2/crxinternal/test_runner/reporter/v8-serializerinternal/modules/esm/initialize_import_metainternal/modules/esm/create_dynamic_moduleinternal/deps/v8/tools/tickprocessor-driverinternal/deps/cjs-module-lexer/dist/lexerinternal/deps/acorn/acorn-walk/dist/walkinternal/bootstrap/web/exposed-window-or-workerinternal/bootstrap/switches/is_not_main_threadinternal/bootstrap/switches/is_main_threadinternal/bootstrap/switches/does_own_process_stateinternal/bootstrap/switches/does_not_own_process_state" - Source: "00000000-00006528.00000000.169509.0002C000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v20.18.3/win-x64/node.libcommonprogramfiles=c:\program" - Source: "00000000-00006528.00000000.169509.00044000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v20.18.3/node-v20.18.3.tar.gzhttps://nodejs.org/download/release/v20.18.3/node-v20.18.3-headers.tar.gz_http_agent_http_client_http_common_http_incoming_http_outgoing_http_server_stream_duplex&_stream_passthrough" - Source: "00000000-00006528.00000000.169509.00068000.00000004.mdmp") Found URL "https://github.com/nodejs/node/issuesthis" - Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp") Found URL "https://github.com/nodejs/node/issueserr_invalid_address_familyaddresstypeerr_invalid_arg_typeexpected'name'" - Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp") Found URL "https://chromewebstore.google.com/querystring$internal/constants,internal/streams/utilsutil" - Source: "00000000-00006528.00000000.169509.00368000.00000004.mdmp") Found URL "https://chrome.google.com/webstorem" - Source: "00000000-00006528.00000000.169509.006D0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json11/05" - Source: "00000000-00006528.00000000.169509.00C30000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,011/05" - Source: "00000000-00006528.00000000.169509.00C30000.00000002.mdmp") Found URL "https://chrome.google.com/webstore?hl=enctrl$1+$2press" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "http://'" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://'" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://myactivity.google.com/" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://policies.google.com/" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://support.google.com/chromebook?p=app_intent" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://chrome.google.com/webstore/category/extensions" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://www.example.comurl" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://www.google.com/chrome/privacy/eula_text.htmlh&elpmanaged" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://chromeenterprise.google/policies/" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "http://," - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://," - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://passwords.google.comgoogle" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?utm_source=chrome_nhttps://myactivity.google.com/myactivity/?utm_source=chrome_h-p" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://chromestatus.com/features" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://example.com.use" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://support.google.com/chrome/a/answer/9122284" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "http://," - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp") Found URL "https://support.google.com/chrome/answer/6098869" - Source: "00000000-00006528.00000000.169509.80130000.00000002.mdmp")4a:Ta5f,"VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\3Lhs95VwVDmnypCbYl7p0o9fgvJ (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\3Lhs95VwVDmnypCbYl7p0o9fgvJ\*.* (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\app-64.7z (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\resources\elevate.exe (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\chrome_100_percent.pak (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\chrome_200_percent.pak (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\d3dcompiler_47.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\ffmpeg.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\icudtl.dat (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\libEGL.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\libGLESv2.dll (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\LICENSE.electron.txt (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\LICENSES.chromium.html (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\locales\af.pak (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\locales\am.pak (UID: 00000000-00005220) "VibePanel1.0.0.exe" called "FindFirstFileW" with parameter %TEMP%\nsjB68.tmp\7z-out\locales\ar.pak (UID: 00000000-00005220)4b:Ta3b,Found string "Google" (Indicator: "password"; Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found string "passwords.google.com" (Indicator: "password"; Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found string "$1 password?" (Indicator: "password"; Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found string "Manage password" (Indicator: "password"; Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found string "We were not able to delete all passwords stored in your Google Account. Try again or visit passwords.google.com.Some passwords were not deletedOk, got it" (Indicator: "password"; Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found string "https://passwords.google.comGoogle" (Indicator: "password"; Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found string "SuggestedAll passwordsFill passwordView details" (Indicator: "password"; Source: "00000000-00005220.00000000.168176.03230000.00000004.mdmp") Found string "password-change" (Indicator: "password"; Source: "00000000-00006528.00000000.169509.00004000.00000004.mdmp, 00000000-00006528.00000000.169509.00780000.00000004.mdmp") Found string "password-manager" (Indicator: "password"; Source: "00000000-00006528.00000000.169509.00004000.00000004.mdmp") Found string "This document is password protected. Please enter a password." (Indicator: "password"; Source: "00000000-00006528.00000000.169509.0002C000.00000004.mdmp") Found string "per_realm_crypto_key_object_secret_constructor" (Indicator: "secret"; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.00304000.00000004.mdmp") Found string "get passworda" (Indicator: "password"; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp") Found string "set passworda" (Indicator: "password"; Source: "00000000-00006528.00000000.169509.00100000.00000004.mdmp") Found string "passwords" (Indicator: "password"; Source: "00000000-00006528.00000000.169509.00110000.00000004.mdmp, 00000000-00006528.00000000.169509.00430000.00000004.mdmp") Found string "get password" (Indicator: "password"; Source: "00000000-00006528.00000000.169509.00304000.00000004.mdmp") Found string "set password" (Indicator: "password"; Source: "00000000-00006528.00000000.169509.00304000.00000004.mdmp")4c:T79b,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005220.00000000.168176.005D0000.00000004.mdmp, 00000000-00005220.00000000.168176.021B0000.00000004.mdmp, 00000000-00005220.00000000.168176.02310000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005220.00000000.168176.005D0000.00000004.mdmp, 00000000-00005220.00000000.168176.021B0000.00000004.mdmp, 00000000-00005220.00000000.168176.02310000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00005220.00000000.168176.005D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005220.00000000.168176.005D0000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00006528.00000000.169509.0002C000.00000004.mdmp") Found string "C:\WINDOWS\system32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00006528.00000000.169509.0002C000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00006528.00000000.169509.00044000.00000004.mdmp, 00000000-00006528.00000000.169509.00054000.00000004.mdmp, 00000000-00006528.00000000.169509.00990000.00000004.mdmp, 00000000-00006528.00000000.169509.009C0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00006528.00000000.169509.00044000.00000004.mdmp, 00000000-00006528.00000000.169509.00054000.00000004.mdmp, 00000000-00006528.00000000.169509.00990000.00000004.mdmp, 00000000-00006528.00000000.169509.009C0000.00000004.mdmp") Found string "32\drivers\etc\" (Indicator: "\drivers\"; Source: "00000000-00006528.00000000.169509.00094000.00000004.mdmp")4d:Tbfa,"VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\UCPD"; Key: "SUPPORTEDFEATURES"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFILTER"; Key: "SUPPORTEDFEATURES"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\3LHS95VWVDMNYPCBYL7P0O9FGVJ\VIBE PANEL.EXE"; Value: "") "Vibe Panel.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Vibe Panel.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "Vibe Panel.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "Vibe Panel.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "Vibe Panel.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "Vibe Panel.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "Vibe Panel.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "Vibe Panel.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "Vibe Panel.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "Vibe Panel.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "Vibe Panel.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "")4e:T9cd,Found string "MulDiv" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "DeleteFileW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "FindNextFileW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "FindClose" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "SetFilePointer" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "ReadFile" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "MultiByteToWideChar" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "lstrlenA" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "WideCharToMultiByte" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "GetPrivateProfileStringW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNEL32.DLL) Found string "WritePrivateProfileStringW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNEL32.DLL) Found string "FreeLibrary" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "LoadLibraryExW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "GetModuleHandleW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalAlloc" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "GlobalFree" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "ExpandEnvironmentStringsW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "lstrcmpiW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "CloseHandle" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "SetFileTime" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "CompareFileTime" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "SearchPathW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL) Found string "GetShortPathNameW" (Source: Vibe Panel 1.0.0.exe, API is part of module: KERNELBASE.DLL)4f:Te97,"VibePanel1.0.0.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\System.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VibePanel1.0.0.exe" wrote 41980 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\7z-out\resources\elevate.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VibePanel1.0.0.exe" wrote 12969 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\7z-out\d3dcompiler_47.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VibePanel1.0.0.exe" wrote 11401 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\7z-out\ffmpeg.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0900 ... "VibePanel1.0.0.exe" wrote 50357 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\7z-out\libEGL.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0a00 ... "VibePanel1.0.0.exe" wrote 16049 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\7z-out\libGLESv2.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0a00 ... "VibePanel1.0.0.exe" wrote 23905 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\7z-out\Vibe Panel.exe": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0f00 ... "VibePanel1.0.0.exe" wrote 47577 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\7z-out\vk_swiftshader.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0a00 ... "VibePanel1.0.0.exe" wrote 19267 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsjB68.tmp\7z-out\vulkan-1.dll": 4d5a78000100000004000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000780000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e2400005045000064ff0a00 ...50:T4fe,"Vibe Panel.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\vibe-panel\Local Storage\leveldb__tmp_for_rebuild" "Vibe Panel.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\vibe-panel\Local Storage\leveldb" "Vibe Panel.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\vibe-panel\Local Storage\leveldb\LOG" "Vibe Panel.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\vibe-panel\Local Storage\leveldb\CURRENT" "Vibe Panel.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\vibe-panel\Local Storage\leveldb\000001.dbtmp" "Vibe Panel.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\vibe-panel\Local Storage\leveldb\MANIFEST-000001" "Vibe Panel.exe" trying to open a file "%APPDATA%\vibe-panel\Local Storage\leveldb__tmp_for_rebuild" "Vibe Panel.exe" trying to open a file "%APPDATA%\vibe-panel\Local Storage\leveldb" "Vibe Panel.exe" trying to open a file "%APPDATA%\vibe-panel\Local Storage\leveldb\LOG" "Vibe Panel.exe" trying to open a file "%APPDATA%\vibe-panel\Local Storage\leveldb\CURRENT" "Vibe Panel.exe" trying to open a file "%APPDATA%\vibe-panel\Local Storage\leveldb\000001.dbtmp" "Vibe Panel.exe" trying to open a file "%APPDATA%\vibe-panel\Local Storage\leveldb\MANIFEST-000001"51:T68e,"VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.DLL"; Key: "NEVERSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.TXT"; Key: "ALWAYSSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\TEXT"; Key: "ALWAYSSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.TXT"; Key: "NEVERSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\TEXT"; Key: "NEVERSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.HTML"; Key: "ALWAYSSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\DOCUMENT"; Key: "ALWAYSSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.HTML"; Key: "NEVERSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\DOCUMENT"; Key: "NEVERSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "ALWAYSSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "NEVERSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.PS1"; Key: "ALWAYSSHOWEXT") "VibePanel1.0.0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.PS1"; Key: "NEVERSHOWEXT")52:T8a9,Spawned process "VibePanel1.0.0.exe" (UID: 00000000-00005220) Spawned process "Vibe Panel.exe" (UID: 00000000-00006528) Spawned process "powershell.exe" with commandline "-NoProfile -ExecutionPolicy Bypass -File %TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app\\helper\\run.ps1" (UID: 00000000-00005168) Spawned process "Vibe Panel.exe" with commandline ""%APPDATA%\\vibe-panel" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1820,i,8842748339954737895,14529333568089446198,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2" (UID: 00000000-00003380) Spawned process "csc.exe" with commandline "/noconfig /fullpaths @"%TEMP%\\mjhduqa3\\mjhduqa3.cmdline"" (UID: 00000000-00001672) Spawned process "cvtres.exe" with commandline "/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\\RES999D.tmp" "%TEMP%\\mjhduqa3\\CSCF40100CB19CE4A97BCCCA7616758B559.TMP"" (UID: 00000000-00001084) Spawned process "Vibe Panel.exe" with commandline ""%APPDATA%\\vibe-panel" --field-trial-handle=2236,i,8842748339954737895,14529333568089446198,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3" (UID: 00000000-00008812) Spawned process "Vibe Panel.exe" with commandline ""%APPDATA%\\vibe-panel" --app-path="%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app" --no-sandbox --no-zygote --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1793916530866968 --launch-time-ticks=2661691898 --field-trial-handle=3280,i,8842748339954737895,14529333568089446198,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1" (UID: 00000000-00002344)53:T505,"Vibe Panel.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8"; Key: "BLOB") "Vibe Panel.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "Vibe Panel.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\06F1AA330B927B753A40E68CDF22E34BCBEF3352"; Key: "BLOB") "Vibe Panel.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "Vibe Panel.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "Vibe Panel.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\2B45CA4F1FAC7F93EC09EABC096123B1E95C0108"; Key: "BLOB") "Vibe Panel.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\31F9FC8BA3805986B721EA7295C65B3A44534274"; Key: "BLOB") "Vibe Panel.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "Vibe Panel.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB")54:Tbd6,"SELECT value FROM meta WHERE key=?" (Source: 00000000-00000916.00000000.249474.00004000.00000004.mdmp, Indicator: "select value from meta where key=?") "SELECT COUNT(primary_key) FROM dictionaries" (Source: 00000000-00000916.00000000.249474.00024000.00000004.mdmp, Indicator: "select count(primary_key) from dictionaries"), "DELETE FROM dictionaries WHERE exp_time<=? RETURNING size token_high token_low" (Source: 00000000-00000916.00000000.249474.0004C000.00000004.mdmp, Indicator: "delete from dictionaries where exp_time<=? returning size token_high token_low"), "CREATE TABLE trust_tokens_issuer_toplevel_pair_config ( key TEXT, proto BLOB, PRIMARY KEY(key))" (Source: 00000000-00000916.00000000.249474.00168000.00000004.mdmp, Indicator: "create table trust_tokens_issuer_toplevel_pair_config ( key text, proto blob, primary key(key))"), "CREATE TABLE trust_tokens_issuer_toplevel_pair_config ( key TEXT, proto BLOB, PRIMARY KEY(key))p" (Source: 00000000-00000916.00000000.249474.00168000.00000004.mdmp, Indicator: "create table trust_tokens_issuer_toplevel_pair_config ( key text, proto blob, primary key(key))p"), "CREATE TABLE trust_tokens_toplevel_config ( key TEXT, proto BLOB, PRIMARY KEY(key))W" (Source: 00000000-00000916.00000000.249474.00168000.00000004.mdmp, Indicator: "create table trust_tokens_toplevel_config ( key text, proto blob, primary key(key))w"), "CREATE TABLE trust_tokens_issuer_config ( key TEXT, proto BLOB, PRIMARY KEY(key))S" (Source: 00000000-00000916.00000000.249474.00168000.00000004.mdmp, Indicator: "create table trust_tokens_issuer_config ( key text, proto blob, primary key(key))s"), "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)'" (Source: 00000000-00000916.00000000.249474.00168000.00000004.mdmp, Indicator: "create table meta(key longvarchar not null unique primary key, value longvarchar)'"), "CREATE TABLE sqlite_sequence(name,seq)" (Source: 00000000-00000916.00000000.249474.00168000.00000004.mdmp, Indicator: "create table sqlite_sequence(name,seq)"), "CREATE TABLE dictionaries(primary_key INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,frame_origin TEXT NOT NULL,top_frame_site TEXT NOT NULL,host TEXT NOT NULL,match TEXT NOT NULL,match_dest TEXT NOT NULL,id TEXT NOT NULL,url TEXT NOT NULL,last_fetch_time INTEGER NOT NULL,res_time INTEGER NOT NULL,exp_time INTEGER NOT NULL,last_used_time INTEGER NOT NULL,size INTEGER NOT NULL,sha256 BLOB NOT NULL,token_high INTEGER NOT NULL,token_low INTEGER NOT NULL)f" (Source: 00000000-00000916.00000000.249474.00168000.00000004.mdmp, Indicator: "create table dictionaries(primary_key integer not null primary key autoincrement,frame_origin text not null,top_frame_site text not null,host text not null,match text not null,match_dest text not null,id text not null,url text not null,last_fetch_time integer not null,res_time integer not null,exp_time integer not null,last_used_time integer not null,size integer not null,sha256 blob not null,token_high integer not null,token_low integer not null)f")55:T5cc,Found string "+ncalrpc:[OLEA4AECB155556E044480F1B1701D7]" (Indicator: "ncalrpc"; Source: "00000000-00000464.00000001.248382.007A0000.00000004.mdmp, 00000000-00000464.00000001.248382.03F60000.00000004.mdmp, 00000000-00000464.00000002.250302.007A0000.00000004.mdmp, 00000000-00000464.00000002.250302.03F60000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00000464.00000001.248382.007A0000.00000004.mdmp, 00000000-00000464.00000002.250302.007A0000.00000004.mdmp") Found string "B+ncalrpc:[OLEA4AECB155556E044480F1B1701D7]" (Indicator: "ncalrpc"; Source: "00000000-00000464.00000001.248382.007A0000.00000004.mdmp, 00000000-00000464.00000001.248382.03750000.00000004.mdmp, 00000000-00000464.00000002.250302.007A0000.00000004.mdmp, 00000000-00000464.00000002.250302.03750000.00000004.mdmp") Found string "+ncalrpc:[OLEF6ED422A49D05B61FD2E987C0031]" (Indicator: "ncalrpc"; Source: "00000000-00000916.00000000.249474.11710000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00000916.00000000.249474.11710000.00000004.mdmp") Found string "+ncalrpc:[OLEEB00BB9AE2D698A2F731AAE0BB28]" (Indicator: "ncalrpc"; Source: "00000000-00000916.00000000.249474.11710000.00000004.mdmp") Found string "K+ncalrpc:[OLEEB00BB9AE2D698A2F731AAE0BB28]" (Indicator: "ncalrpc"; Source: "00000000-00000916.00000000.249474.11710000.00000004.mdmp")56:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")57:T4d8a,Executable loaded in memory "MZ@ !L!This program cannot be run in DOS mode. $PELj!J~i @,iO H.textI J `.rsrcL@@.relocP@B`iH8(1/!rprp( ( ( s z*0st o(_*0~ o(_*0o -( -(c( -*o(_r!ps }} o (_{ 3!{~ ( ,{( (\&&*#t04rkpo /Xo .o i1rsp( -rwp+rp ~ rp rp rp ( o -݊r'po urypo uo ( -+( -"( ,rprp( )( -( -&*A++0-*( o! &*0}(`~(at o((_o1(_s" [o# &8o2(_-to>&&o=& o? &t o.(_ o0(_ - rp +(d( - +rp o$ 1 ,o# & rpo% (mo% rpo% (mo% r+po% (no% rApo% (oo% }o# &&X? ]o# & o& *ALlxH\0(`~(at o((_o1(_ +F o2(_-.to=&(' ,t & X 2rSps z*5?t0o(_(( toA(_rwps) 8oB(_o (_(b( ,r{p o$ 1 ,o# & rpo% (mo% rpo% (mo% }o# &&X?p ]o# & o& (* &*;0 st (` o (_&(`o (_& rp(grp(grp(mrp(mrp( *&)B0" + oO(_Xi2*0" + oZ(_Xi2*0( ,rps z-+ sCt(irp(rL sDt(jrp(r#,+rpo+ ( s z*>"`e$ 0-rCpo, Xs- 8o. YED(RR6 ". \.+FrEpo% &+lrKpo% &+^rQpo% &+PrWpo% &+Br]po% &+4 /'rcpo% rip( ( o% &+o# &Xo, ?Co& *Zrop(lrop(/ *0 l rsp( (0 *>-rwp*rp*z"4"*"?6"?**0a'' 'o i2( (1 & %(9~:s3 %rp(4 %rp(4 %rp(4 %rp(4 %rp(4 %rp(4 %rp(4 %rp(4 %rp(4 %rp (4 %r+p (4 %r?p(4 %rOp(4 %r]p (4 %rmp(4 ~()(5 9)E\XL/ARc8m(`~(at o(_o(_(b-rwp**rp*(n*rAp*(o*rp*(m*rp*( (r&? ( (6 (p (`~(at ~7 o(_rp(r&rp( (`~(at ~7 o(_rp(r&ݕ(`~(ato"(_"4""?6"?rp(nrp(/ (r&,(`~(at o(_o(_++rp+(n+rAp+(o+rp+(e+rp+( (r&ݙX ( (6 (p(f~7 o-(_rp(r&GXrp( (f~7 o/(_rp(r& ( (6 (p(`~(at ~7 o(_rp(r&ݥrp( (`~(at ~7 ! !o(_rp(r&U"p"(]&rp"( (8 rp(/ (r&#(9 &#4##6#q#n(: (^$rp$-rwp+rprp(/ (r&(h(r&ݰ(k&ݟ(k&ݎrp(r&rp( (; rp(/ &`%,,rp,( (; ,r_p,%o+ , %o+ +rp(m,rp,( &&*A8`09 rp( (; rprp( *0J~,~+s" strpo% &o rprp(< ,rp+rprp( o% & -- o& ~~ o rprp(< rp(/ o% & -- o& trGpo% &o( rkprp(< rp(/ o% & -- o& *o1 rp rp(< rp rp (= o% & 88 o2 !!rp! !rp!rp(< ! ,rp+rp!rp!(= o% & : 9 t o. ""rp" "rp"(n"rp"rp(< "rp"(= o% &K ##rp# #rp# o+ #rp#(= o% & to> o=& $$rp$ $r#p$%$rp$rp(< $r1p$,o, (> o? +r;p$rp$(= o% &K%%rp% %rEp%o+ %rp%(= o% & X / ?!r[po+ rp(/ o% &o rprp(< rp(/ o% & :9~~ o rprp(< rp(/ o% & :9to" &&rp&(n&rp&rp(< &rp&( o% &!rpo+ rp(/ o% &o rprp(< rp(/ o% & :9r!ps }} o { 3{~ ( -+{( (\&''r9p'rp(< 'r[p'{ ''rep',+rsp'rp'(= o% &!r}po+ rp(/ o% &!rpo+ rp(/ o% &o& **AuiKbK!fa!!!rps rps rE ps *BSJBv4.0.30319l #~0#Strings #USL*#GUID\*#BlobW= %3't? mU 6 q 6 6 < 6 uUU6 6 6 6 6 6 06 ;6 y 6 7 ^ N g N (/yU !-!3! O!c! m! y! !!!"!&!-!1!3!A+! C>! DV!Ed!Qw! \E u V V VVVhlooooruQPlQblQtlQl1h1h1h $(1<!D FD rI{T\bx~DDx.C^!s"#&)+-/02!30x4E5T8ax9y:0x<=@CDDDE DF#DG>HNJKM^bNnObQy\RS\UVXYD[D\\]*\^Gx_T`j`bab$d$d"d(fDi/j6m"q"s"u>w>{'J:Q"(/6""">>'J:Q a h qP &yx +~ r <!I"Y#k$|%&'''())))*00 7& ! + b g n g n % + 1 6 H M S H M [ b m m t | | n n g n b n n b n b n +.n 1.n 1n 7=EEGIGKn P1$9I$QY$a$iqM$r! % - < B s $ )$) ) ) 6 M) R )<$!!h))<AF1L- R @W D\ H L.#.+;CS;#CS;\#CS#;C;CCSc;cCSCS; CS;4CS;^CS;;CS#;C;c;0cCSCS;Z#;? >Wfs|<XNX@c@czeusxdz5.dllEDataFlowAudioHelperERoleMMDeviceEnumeratorComObjectIMMDeviceEnumeratorIMMDevicePROPERTYKEYPropVariantIPropertyStoreIAudioEndpointVolumeIAudioMeterInformationIAudioSessionManager2ISimpleAudioVolumeIAudioSessionEnumeratorIAudioSessionControl2IMMDeviceCollectionPolicyConfigClientPolicyConfigClientVistaIPolicyConfigIPolicyConfigVistaVibeHelpermscorlibSystemEnumObjectValueTypevalue__eRendereCaptureeConsoleeMultimediaeCommunications.ctorEnumAudioEndpointsGetDefaultAudioEndpointGetDeviceRegisterEndpointNotificationCallbackUnregisterEndpointNotificationCallbackGuidActivateOpenPropertyStoreGetIdGetStatefmtidpidvtr1r2r3ptrextraGetCountGetAtGetValueSetValueCommitRegisterControlChangeNotifyUnregisterControlChangeNotifyGetChannelCountSetMasterVolumeLevelSetMasterVolumeLevelScalarGetMasterVolumeLevelGetMasterVolumeLevelScalarSetChannelVolumeLevelSetChannelVolumeLevelScalarGetChannelVolumeLevelGetChannelVolumeLevelScalarSetMuteGetMuteGetVolumeStepInfoVolumeStepUpVolumeStepDownQueryHardwareSupportGetVolumeRangeGetPeakValueGetMeteringChannelCountGetChannelsPeakValuesGetAudioSessionControlGetSimpleAudioVolumeGetSessionEnumeratorRegisterSessionNotificationUnregisterSessionNotificationRegisterDuckNotificationUnregisterDuckNotificationSetMasterVolumeGetMasterVolumeGetSessionCountGetSessionGetDisplayNameSetDisplayNameGetIconPathSetIconPathGetGroupingParamSetGroupingParamRegisterAudioSessionNotificationUnregisterAudioSessionNotificationGetSessionIdentifierGetSessionInstanceIdentifierGetProcessIdIsSystemSoundsSessionSetDuckingPreferenceItemGetMixFormatGetDeviceFormatResetDeviceFormatSetDeviceFormatGetProcessingPeriodSetProcessingPeriodGetShareModeSetShareModeGetPropertyValueSetPropertyValueSetDefaultEndpointSetEndpointVisibilitySPI_GETMOUSESPEEDSPI_SETMOUSESPEEDSPIF_UPDATEINIFILESPIF_SENDCHANGEIID_IAudioEndpointVolumeIID_IAudioMeterInformationIID_IAudioSessionManager2PropVariantClearSystemParametersInfoGetSystemParametersInfoSetFailGetDefaultDeviceFriendlyNameRegFriendlyNameProcessNameForPidReadSessionsJsonFindSessionEndpointsJsonDevicesJsonSetRolesSetDefaultEndpointJsonEscJStrJNumJBoolClamp01HandleWrapSystem.TextStringBuilderLogProbeDebugProbedataFlowstateMaskcollectionSystem.Runtime.InteropServicesOutAttributeroledeviceidMarshalAsAttributeUnmanagedTypeclientiidclsCtxactivationParamsifacestgModestorestatecountindexkeyvaluenotifychannelslevelDbctxlevelmutestepstepssupportminDbmaxDbincDbpeakpeaksInAttributeguidflagscontrolvolumeenumeratorsoundssessionnamepathgroupIdenabledevpFormatbOldpOldFormatpNewFormatbDefaultpDefaultpActualpPeriodpModeiFxIndexpvbVisibleactionuiParampvParamfWinInihrflowendpointIdenpcrolesdevIdcapturesvblinedataSystem.Runtime.CompilerServicesCompilationRelaxationsAttributeRuntimeCompatibilityAttributezeusxdz5ComImportAttributeGuidAttributeInterfaceTypeAttributeComInterfaceTypePreserveSigAttributeStructLayoutAttributeLayoutKindDllImportAttributeole32.dlluser32.dllSystemParametersInfoASystem.GlobalizationCultureInfoget_InvariantCultureInt32IFormatProviderToStringStringConcatExceptionIntPtrZeroIsNullOrEmptyop_InequalityMarshalPtrToStringUniIndexOfSubstringCharSplitop_EqualityMicrosoft.Win32RegistryRegistryKeyLocalMachineOpenSubKeyCloseSystem.DiagnosticsProcessGetProcessByIdget_ProcessNameAppendget_LengthStringComparisonEqualsGetObjectForIUnknownReleaseget_Messageget_CharsDoubleNumberStylesTryParse{082222EE-ACE2-4AF7-AC91-E16FCC70F31D}CompilerGeneratedAttributeSystem.Collections.GenericDictionary`2$$method0x6000071-1AddTryGetValueSingleParseEmptyUInt32op_ExplicitMathMinInt16.cctorCOM error 0xX8IA45C254E-DF1C-4EFD-8020-67D146A850E0}.{1 RenderCaptureuSOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\\\PropertiesQ{a45c254e-df1c-4efd-8020-67d146a850e0},2Q{b3f8fa53-0004-438e-9003-51a46e139bfc},6 ()!8AB5<=K5 72C:8@8;>65=85 {"id":,"name":,"volume":,"mute":#session not found[#AB@>9AB2> {"in":,"out":,"inDef":,"outDef":}#missing device id{"ok":true})SetDefaultEndpoint: \"\\\n\r\t\ux4"Rfalse truemicmic-setmic-mutemetermixermix-setmix-mutemaster-setmaster-mutemousemouse-setdevices in-setout-set exit8:@>D>={"volume":0{"peak":){"master":{"volume":},"sessions":{"speed": {"ok":A,"ok":false,"err":"unknown cmd"}%,"ok":false,"err":error%,"ok":true,"data":%[1] enumerator ok ![2] render hr=0x ok null /[3] activate mgr2 hr=0x#[4] cast mgr2 ok )[5] enumerator hr=0x[6] count hr=0x count=[s] hr=0x obj ] vol= hr=0x!] vol cast EXC: ] pid= id= null] c2 EXC: '[4] cast mgr2 EXC: #[7] capture hr=0x1[8] meter activate hr=0x[9] peak=)[9] meter cast EXC: ![10] store hr=0x![11] value hr=0x vt= name= NULL![10] store EXC: [outer] I5CDF2C82-841E-4546-9722-0CF74078229AIC02216F6-8C67-4B5B-9D00-D008E73E0064I77AA99A0-1BD6-484F-8BC7-2C654C9A9B6F""Jopz\V4 $ 4 8 pq 4 L P ! )$BCDE0395-E52F-467C-8E3D-C4579291692E)$A95664D2-9614-4F35-A746-DE8DB63617E6 =)$D666063F-1587-4E43-81F1-B948E807363F I)$886D8EEB-8CF2-444E-878D-F2BC1850A23F)$5CDF2C82-841E-4546-9722-0CF74078229A)$C02216F6-8C67-4B5B-9D00-D008E73E0064)$77AA99A0-1BD6-484F-8BC7-2C654C9A9B6F)$87CE5498-68D6-44E5-9215-6DA47EF883D8)$E2F5BB11-0570-40CA-ACDD-3AA01277DEE8)$BFB7FF88-7239-4FC9-8FA2-07C950BE9C6D)$0BD7A1BE-7A1A-44DB-8397-CC5392387B5E)$870af99c-171d-4f9e-af0d-e63df40c2bc9)$294935CE-F637-4E7C-A41B-AB255460B862)$f8679f50-850a-41cf-9c72-430f290290c8)$568b9108-44bf-40b4-9006-86afe5b5a620Q Y$ u u uy y 08< 4}08<4 @ aLaPa Y Y Y E-(((,(44(( a F(084a< aa,a$ aaTWrapNonExceptionThrowsTini `i_CorDllMainmscoree.dll% 0HXLL4VS_VERSION_INFO?DVarFileInfo$TranslationStringFileInfo000004b0,FileDescription 0FileVersion0.0.0.0< InternalNamezeusxdz5.dll(LegalCopyright D OriginalFilenamezeusxdz5.dll4ProductVersion0.0.0.08Assembly Version0.0.0.0`9"30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1793919596824,"unified_at":"2026-11-05T22:59:56.824Z","metadata":{"hashes":{"sha256":"e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","sha1":"158512cc71d46849d473a621d2b2c48affc0e071","md5":"2054011e4646d8cc07c8345bb55c0605","sha512":"f27098810027c6b38e16923345bd45a0354121af3ca4840ea9185e774530b490adf0c2af5c219d70576c3f907c9abe66f1f47f33f30e1d356ff0d84aa2495333","ssdeep":"1572864:M7ppX2kH/lsZ4q/f9dqPhVRdaqBuLyR2FAqmKEMJskdYzK7:cppmIe4qNdqPnRdaqMBAGJsTG7","ssdeep_chunks":["1572864:M7ppX2k","1572864:7ppX2kH","1572864:ppX2kH/","1572864:pX2kH/l","1572864:X2kH/ls","1572864:2kH/lsZ","1572864:kH/lsZ4","1572864:H/lsZ4q","1572864:/lsZ4q/","1572864:lsZ4q/f","1572864:sZ4q/f9","1572864:Z4q/f9d","1572864:4q/f9dq","1572864:q/f9dqP","1572864:/f9dqPh","1572864:f9dqPhV","1572864:9dqPhVR","1572864:dqPhVRd","1572864:qPhVRda","1572864:PhVRdaq","1572864:hVRdaqB","1572864:VRdaqBu","1572864:RdaqBuL","1572864:daqBuLy","1572864:aqBuLyR","1572864:qBuLyR2","1572864:BuLyR2F","1572864:uLyR2FA","1572864:LyR2FAq","1572864:yR2FAqm","1572864:R2FAqmK","1572864:2FAqmKE","1572864:FAqmKEM","1572864:AqmKEMJ","1572864:qmKEMJs","1572864:mKEMJsk","1572864:KEMJskd","1572864:EMJskdY","1572864:MJskdYz","1572864:JskdYzK","1572864:skdYzK7","3145728:M7ppX2k","3145728:7ppX2kH","3145728:ppX2kH/","3145728:pX2kH/l","3145728:X2kH/ls","3145728:2kH/lsZ","3145728:kH/lsZ4","3145728:H/lsZ4q","3145728:/lsZ4q/","3145728:lsZ4q/f","3145728:sZ4q/f9","3145728:Z4q/f9d","3145728:4q/f9dq","3145728:q/f9dqP","3145728:/f9dqPh","3145728:f9dqPhV","3145728:9dqPhVR","3145728:dqPhVRd","3145728:qPhVRda","3145728:PhVRdaq","3145728:hVRdaqB","3145728:VRdaqBu","3145728:RdaqBuL","3145728:daqBuLy","3145728:aqBuLyR","3145728:qBuLyR2","3145728:BuLyR2F","3145728:uLyR2FA","3145728:LyR2FAq","3145728:yR2FAqm","3145728:R2FAqmK","3145728:2FAqmKE","3145728:FAqmKEM","3145728:AqmKEMJ","3145728:qmKEMJs","3145728:mKEMJsk","3145728:KEMJskd","3145728:EMJskdY","3145728:MJskdYz","3145728:JskdYzK","3145728:skdYzK7","1572864:cppmIe4","1572864:ppmIe4q","1572864:pmIe4qN","1572864:mIe4qNd","1572864:Ie4qNdq","1572864:e4qNdqP","1572864:4qNdqPn","1572864:qNdqPnR","1572864:NdqPnRd","1572864:dqPnRda","1572864:qPnRdaq","1572864:PnRdaqM","1572864:nRdaqMB","1572864:RdaqMBA","1572864:daqMBAG","1572864:aqMBAGJ","1572864:qMBAGJs","1572864:MBAGJsT","1572864:BAGJsTG","1572864:AGJsTG7"],"imphash":"b34f154ec913d2d2c435cbd644e91687","pehash":"6b447066970e1aec2029a282114552d34a37b6de"},"file_info":{"file_name":"Vibe Panel 1.0.0.exe","file_type":["compressed","7zip"],"file_type_id":"7zip nsis","file_size":80131627,"entropy":8,"compile_timestamp":"2018-12-15T22:26:14","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793918951000,"last_seen":1793919060000,"last_multi_scan":1793919060000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":26151,"raw_size":26624},{"name":".rdata","virtual_address":"0x8000","virtual_size":5282,"raw_size":5632},{"name":".data","virtual_address":"0xa000","virtual_size":462840,"raw_size":1536},{"name":".ndata","virtual_address":"0x7b000","virtual_size":589824},{"name":".rsrc","virtual_address":"0x10b000","virtual_size":13952,"raw_size":14336}],"section_names":[".text",".rdata",".data",".ndata",".rsrc"],"imported_dlls":null,"imported_functions":null},"additional_metadata":[{"name":"package_manager","type":"str","values":["nsis"]}]},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":101},"sandbox_signatures":{"informative_count":210,"suspicious_count":23,"malicious_count":4,"total":237},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"Calls an API typically used to performs encryption on the data"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Able to perform encrypt/decrypt operation"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"informative","value":"YARA signature match - Office macro contains PowerShell commands"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to gather system information"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns many processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"suspicious","value":"Attempts to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to move file or directory"},{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Able to access file/directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"informative","value":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"},{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to evade Sandbox environment"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"informative","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"informative","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Lateral Movement","technique":"Cloud Services","attack_id":"T1021.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/007","identifiers":[{"type":"informative","value":"Able to connect to a cloud service"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"},{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"},{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Reads the hosts file"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - Embedded PDF document"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Able to kill processes"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Able to access browser directory location"},{"type":"suspicious","value":"Found browsers sensitive information related strings"},{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"suspicious","value":"Tries to access browsers/wallets sensitive information (file access)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Found registry location strings which can modify COM objects"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"malicious","value":"Executes powershell requesting to bypass execution policy"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Execution","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"suspicious","value":"Contains ability to use Webdav for network"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"suspicious","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]}],"sandbox_signatures":[{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-269","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\"), Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumValueW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"aeSqB+\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/nsis_error\", Heuristic match: \"\np |.au\", Heuristic match: \"p6.ae\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; Source: \"sample.bin\"), Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"Vibe Panel.exe\" called \"FindResourceW\" with parameter \"380\" - (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00005168-00000BC0-1637248663\")\n Found reference to \"mgf1HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00006528.00000000.169509.00100000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"SHA384\"; Source: \"00000000-00006528.00000000.169509.00200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"Vibe Panel.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 10040000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"VibePanel1.0.0.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"VibePanel1.0.0.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"Vibe Panel.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Vibe Panel.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"powershell.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$37","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$38","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"Vibe Panel.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\vibe-panel\\Code Cache\\wasm\\index-dir\\temp-index\" to \"%APPDATA%\\vibe-panel\\Code Cache\\wasm\\index-dir\\the-real-index\"\n \"Vibe Panel.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\vibe-panel\\Code Cache\\js\\index-dir\\temp-index\" to \"%APPDATA%\\vibe-panel\\Code Cache\\js\\index-dir\\the-real-index\"\n \"Vibe Panel.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Roaming\\vibe-panel\\Local Storage\\leveldb\\000001.dbtmp\" to \"%APPDATA%\\vibe-panel\\Local Storage\\leveldb\\CURRENT\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"fromCharCode\" (Indicator: \"fromcharcode\"; Source: \"00000000-00006528.00000000.169509.00020000.00000002.mdmp, 00000000-00006528.00000000.169509.02950000.00000002.mdmp\")\n Found reference to API \"StringFromCharCode\" (Indicator: \"fromcharcode\"; Source: \"00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.00568000.00000004.mdmp\")\n Found reference to API \"StringFromCharCodeApply\" (Indicator: \"fromcharcode\"; Source: \"00000000-00006528.00000000.169509.00100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005220.00000000.168176.005D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Calls an API typically used to performs encryption on the data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$39","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"Found string \"pending.delete(msg.id);\" (Indicator: \".delete(\"; Source: \"00000000-00006528.00000000.169509.00040000.00000004.mdmp\")\n Found string \"if (pending.has(id)) { pending.delete(id); reject(new Error('helper timeout')); }\" (Indicator: \".delete(\"; Source: \"00000000-00006528.00000000.169509.00040000.00000004.mdmp\")\n Found string \"pending.delete(id);\" (Indicator: \".delete(\"; Source: \"00000000-00006528.00000000.169509.00040000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"https://github.com/nodejs/node/issues\" (Indicator: \"github.com\"; Source: \"00000000-00006528.00000000.169509.00100000.00000004.mdmp\")\n Found string \"Please open an issue with this stack trace at https://github.com/nodejs/node/issues\" (Indicator: \"github.com\"; Source: \"00000000-00006528.00000000.169509.00100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006528-00000C2C-1633490674\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005168-00000C2C-1639019376\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00006528-00000C2C-1633490674\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005168-00000C2C-1639019376\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00005168-00000C2C-1636905694\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00005168-00000C2C-1636906356\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GETADDRINFOREQWRAP\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00006528.00000000.169509.00100000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"VibePanel1.0.0.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005220)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"VibePanel1.0.0.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00005220)\n \"Vibe Panel.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"VibePanel1.0.0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005220)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"VibePanel1.0.0.exe\" called \"IsWow64Process\" with parameter \"5220\" - (UID: 00000000-00005220)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00005168)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"VibePanel1.0.0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005220)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005168)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"kernel32::IsWow64Process2(ps,*i0s,*i)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005220.00000000.168176.005D0000.00000004.mdmp\")\n Found reference to API \"kernel32::IsWow64Process(p-1,*i0s)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005220.00000000.168176.005D0000.00000004.mdmp\")\n Found reference to API \"kernel32::IsWow64Process2(ps,*i,*i0s)\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005220.00000000.168176.005D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"VibePanel1.0.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"VibePanel1.0.0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Vibe Panel.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"Vibe Panel.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005220.00000000.168176.0041E000.00000004.mdmp, 00000000-00005220.00000000.168176.746C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSJB68.TMP\\SYSTEM.DLL\n %TEMP%\\NSJB68.TMP\\NSIS7Z.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"\"Vibe Panel.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\"; Key: \"\"; Value: \"\")\n \"Vibe Panel.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\INTERFACES\\{D27478B9-2058-11E8-B41F-806E6F6E6963}\"; Key: \"ENABLEDHCP\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"VibePanel1.0.0.exe\" queried token user identity (UID: 00000000-00005220)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"VibePanel1.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Vibe Panel.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"VibePanel1.0.0.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\VIBEPANEL1.0.0.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"app-64.7z\" copied on \"%TEMP%\\nsjB68.tmp\\app-64.7z\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"nsis7z.dll\")\n file/memory contains long string(File: \"elevate.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005220.00000000.168176.0041E000.00000004.mdmp, 00000000-00005220.00000000.168176.746C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"VibePanel1.0.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\ (UID: 00000000-00005220)\n \"VibePanel1.0.0.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00005220)\n \"VibePanel1.0.0.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005220)\n \"VibePanel1.0.0.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00005220)\n \"VibePanel1.0.0.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005220)\n \"VibePanel1.0.0.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00005220)\n \"VibePanel1.0.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\nsjB68.tmp (UID: 00000000-00005220)\n \"VibePanel1.0.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ (UID: 00000000-00005220)\n \"VibePanel1.0.0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\nsjB68.tmp\\7z-out (UID: 00000000-00005220)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"\"Vibe Panel.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\FFFFFFFFFFFFFFFF-6528\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006528)\n \"Vibe Panel.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\0000000000000000-6528\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006528)\n \"Vibe Panel.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\?\\pipe\\uv\\0000000000000001-6528\"\n dwOpenMode: \"1074528259\"\n dwPipeMode: \"0\" - (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"VibePanel1.0.0.exe\" called \"CreateProcessW\" with parameter \"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe\" - (UID: 00000000-00005220)\n \"Vibe Panel.exe\" called \"CreateProcessW\" with parameter \"powershell.exe -NoProfile -ExecutionPolicy Bypass -File %TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\\" - (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Vibe Panel.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.6528.1492.13208473225510608037\" - (UID: 00000000-00006528)\n \"Vibe Panel.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\uv\\FFFFFFFFFFFFFFFF-6528\" - (UID: 00000000-00006528)\n \"Vibe Panel.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\uv\\0000000000000000-6528\" - (UID: 00000000-00006528)\n \"Vibe Panel.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\uv\\0000000000000001-6528\" - (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"Vibe Panel.exe\" called \"MoveFileW\" with parameter %APPDATA%\\vibe-panel\\Code Cache\\js\\index-dir\\the-real-index & %APPDATA%\\vibe-panel\\Code Cache\\js\\index-dir\\todelete_7801cff42007fd62 (UID: 00000000-00006528)\n \"Vibe Panel.exe\" called \"MoveFileW\" with parameter %APPDATA%\\vibe-panel\\Code Cache\\wasm\\index-dir\\the-real-index & %APPDATA%\\vibe-panel\\Code Cache\\wasm\\index-dir\\todelete_ea68b8a8bf26531f (UID: 00000000-00006528)\n \"Vibe Panel.exe\" called \"MoveFileW\" with parameter %APPDATA%\\vibe-panel\\Code Cache\\wasm\\index-dir\\temp-index & %APPDATA%\\vibe-panel\\Code Cache\\wasm\\index-dir\\the-real-index (UID: 00000000-00006528)\n \"Vibe Panel.exe\" called \"MoveFileW\" with parameter %APPDATA%\\vibe-panel\\Code Cache\\js\\index-dir\\temp-index & %APPDATA%\\vibe-panel\\Code Cache\\js\\index-dir\\the-real-index (UID: 00000000-00006528)\n \"Vibe Panel.exe\" called \"MoveFileW\" with parameter %APPDATA%\\vibe-panel\\Local Storage\\leveldb/000001.dbtmp & %APPDATA%\\vibe-panel\\Local Storage\\leveldb/CURRENT (UID: 00000000-00006528)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005220.00000000.168176.0041E000.00000004.mdmp, 00000000-00005220.00000000.168176.746C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3e","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"libGLESv2.dll\" as clean (type is \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections\"), Antivirus vendors marked dropped file \"ffmpeg.dll\" as clean (type is \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections\"), Antivirus vendors marked dropped file \"libEGL.dll\" as clean (type is \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections\"), Antivirus vendors marked dropped file \"nsis7z.dll\" as clean (type is \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"), Antivirus vendors marked dropped file \"elevate.exe\" as clean (type is \"PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections\"), Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -File %TEMP%\\\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\\\resources\\\\app\\\\helper\\\\run.ps1\" (UID: 00000000-00005168)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Vibe Panel 1.0.0.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"ffmpeg.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n \"libEGL.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n \"nsis7z.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"elevate.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"System.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\mojo.6528.1492.13208473225510608037","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\" in Source: 00000000-00005220.00000000.168176.00408000.00000002.mdmp\n \"5-21-735145574-3570218355-1207367261-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00006528.00000000.169509.009C0000.00000004.mdmp\n \"istry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006528.00000000.169509.009C0000.00000004.mdmp\n \"\\Machine\\Software\\Classes\\CLSID\\{FA445657-9379-11D6-B41A-00065B83EE53}\" in Source: 00000000-00006528.00000000.169509.009C0000.00000004.mdmp\n \"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00006528.00000000.169509.009C0000.00000004.mdmp\n \"REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\" in Source: 00000000-00006528.00000000.169509.009C0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\6078762b90671c2ff9ba39318e2176d8\\mscorlib.ni.dll\" at E9BB0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"VibePanel1.0.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 764B0000\n \"VibePanel1.0.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76E70000\n \"Vibe Panel.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 1BD40000\n \"Vibe Panel.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 1BB00000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 1BD40000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 1BB00000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at EB210000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"VibePanel1.0.0.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75B70000\n \"Vibe Panel.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 1D350000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 1D350000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000060a3ff1bf87f0000@ntdll.dll\"\n \"220023000000000038a3ff1bf87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"Vibe Panel 1.0.0.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"Vibe Panel 1.0.0.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"ffmpeg.dll\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"ffmpeg.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"libEGL.dll\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"libEGL.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"nsis7z.dll\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"nsis7z.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"elevate.exe\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"elevate.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"System.dll\" was detected as \"Nullsoft Scriptable Install System\" and name: \"Installer\"\n \"System.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$41","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00006528-00000BC0-1634896522]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Vibe Panel.exe\" (UID: 00000000-00006528) was launched with new environment variables: \"PORTABLE_EXECUTABLE_FILE=\"C:\\VibePanel1.0.0.exe\", PORTABLE_EXECUTABLE_APP_FILENAME=\"vibe-panel\", USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PORTABLE_EXECUTABLE_DIR=\"C:\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"Vibe Panel.exe\" (UID: 00000000-00006528) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"powershell.exe\" (UID: 00000000-00005168) was launched with new environment variables: \"ORIGINAL_XDG_CURRENT_DESKTOP=\"undefined\"\"\n Process \"powershell.exe\" (UID: 00000000-00005168) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"powershell.exe\" (UID: 00000000-00005168) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"VibePanel1.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"VibePanel1.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"VibePanel1.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Vibe Panel.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Vibe Panel.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"Vibe Panel.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\USER PROFILE\"; Key: \"LANGUAGES\")\n \"Vibe Panel.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"VibePanel1.0.0.exe\" searching for class \"#32770\"\n \"Vibe Panel.exe\" searching for class \"Chrome_MessageWindow\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Vibe Panel.exe\" (UID: 00000000-00006528)\n Spawned process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -File %TEMP%\\\\3Lhs95VwVDmnypC ...\" (UID: 00000000-00005168)\n Spawned process \"Vibe Panel.exe\" with commandline \"\"%APPDATA%\\\\vibe-panel\" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAA ...\" (UID: 00000000-00003380)\n Spawned process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\mjhduqa3\\\\mjhduqa3.cmdline\"\" (UID: 00000000-00001672)\n Spawned process \"cvtres.exe\" with commandline \"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\\\RES999D.tmp\" \"%TEM ...\" (UID: 00000000-00001084), Spawned process \"Vibe Panel.exe\" with commandline \"\"%APPDATA%\\\\vibe-panel\" --field-trial-handle=2236\ni\n884274833995 ...\" (UID: 00000000-00008812), Spawned process \"Vibe Panel.exe\" with commandline \"\"%APPDATA%\\\\vibe-panel\" --app-path=\"%TEMP%\\\\3Lhs95VwVDmnypCbYl7p ...\" (UID: 00000000-00002344)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Vibe Panel.exe\" (UID: 00000000-00006528)\n Spawned process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -File %TEMP%\\\\3Lhs95VwVDmnypC ...\" (UID: 00000000-00005168)\n Spawned process \"Vibe Panel.exe\" with commandline \"\"%APPDATA%\\\\vibe-panel\" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAA ...\" (UID: 00000000-00003380)\n Spawned process \"csc.exe\" with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\mjhduqa3\\\\mjhduqa3.cmdline\"\" (UID: 00000000-00001672)\n Spawned process \"cvtres.exe\" with commandline \"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\\\RES999D.tmp\" \"%TEM ...\" (UID: 00000000-00001084), Spawned process \"Vibe Panel.exe\" with commandline \"\"%APPDATA%\\\\vibe-panel\" --field-trial-handle=2236\ni\n884274833995 ...\" (UID: 00000000-00008812), Spawned process \"Vibe Panel.exe\" with commandline \"\"%APPDATA%\\\\vibe-panel\" --app-path=\"%TEMP%\\\\3Lhs95VwVDmnypCbYl7p ...\" (UID: 00000000-00002344)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Vibe Panel 1.0.0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"nsis7z.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"elevate.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"System.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"VibePanel1.0.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsjB68.tmp\\System.dll\"\n \"VibePanel1.0.0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsjB68.tmp\\app-64.7z\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"VibePanel1.0.0.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Vibe Panel.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$43","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$44","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"libGLESv2.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections\"- Location: [%TEMP%\\nsjB68.tmp\\7z-out\\libGLESv2.dll]- [targetUID: 00000000-00005220]\n \"ffmpeg.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections\"- Location: [%TEMP%\\nsjB68.tmp\\7z-out\\ffmpeg.dll]- [targetUID: 00000000-00006528]\n \"libEGL.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections\"- Location: [%TEMP%\\nsjB68.tmp\\7z-out\\libEGL.dll]- [targetUID: 00000000-00005220]\n \"nsis7z.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nsjB68.tmp\\nsis7z.dll]- [targetUID: 00000000-00005220]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsjB68.tmp\\System.dll]- [targetUID: 00000000-00005220]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"VibePanel1.0.0.exe\" queries basic process information of the \"C:\\VibePanel1.0.0.exe\" (UID: 5220)\n \"VibePanel1.0.0.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe\" (UID: 5220)\n \"Vibe Panel.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe\" (UID: 6528)\n \"Vibe Panel.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 6528)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 5168)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$45","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"VibePanel1.0.0.exe\" reads file \"c:\\vibepanel1.0.0.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"VibePanel1.0.0.exe\" trying to touch file \"C:\\Windows\\System32\\wow64log.dll\"\n \"VibePanel1.0.0.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"VibePanel1.0.0.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.6280_none_c0dab36c38bfeda0\\comctl32.dll\"\n \"VibePanel1.0.0.exe\" trying to touch file \"C:\\WINDOWS\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.6280_none_c0dab36c38bfeda0\\COMCTL32.dll\"\n \"VibePanel1.0.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"VibePanel1.0.0.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\IMM32.DLL\"\n \"VibePanel1.0.0.exe\" trying to touch file \"\\Device\\KsecDD\"\n \"VibePanel1.0.0.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\oleaut32.dll\"\n \"VibePanel1.0.0.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\oleaut32.dll\"\n \"VibePanel1.0.0.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"\n \"VibePanel1.0.0.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"VibePanel1.0.0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"VibePanel1.0.0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$47","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"VibePanel1.0.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsjb68.tmp\\system.dll\"\n \"VibePanel1.0.0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\nsjb68.tmp\\app-64.7z\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"VibePanel1.0.0.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsjB68.tmp\\7z-out\\icudtl.dat\"\n \"VibePanel1.0.0.exe\" writes a file \"%TEMP%\\nsjB68.tmp\\7z-out\\icudtl.dat\"\n \"Vibe Panel.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\vibe-panel\\Local Storage\\leveldb\\000001.dbtmp\"\n \"Vibe Panel.exe\" writes a file \"%APPDATA%\\vibe-panel\\Local Storage\\leveldb\\000001.dbtmp\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"Found string \"--use-openssl-ca\" (Indicator: \"openssl-\"; Source: \"00000000-00006528.00000000.169509.00044000.00000004.mdmp, 00000000-00006528.00000000.169509.00054000.00000004.mdmp\")\n Found string \"I --openssl-config\" (Indicator: \"openssl-\"; Source: \"00000000-00006528.00000000.169509.00054000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"19.00.0.0\"\n \"127.0.0.1\"\n Potential IP \"127.0.0.1\" found in string \"activate inspector on host:port (default: 127.0.0.1:9229)\"\n Potential IP \"13.0.245.25\" found in string \"13.0.245.25-electron.0\"\n Potential IP \"1.3.0.1\" found in string \"1.3.0.1-motley\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$49","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"nsis7z.dll\"\n YARA signature for AES encryption matched on process \"00000000-00005220\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"file/memory contains long string with (Indicator: \"--user-data-dir\"; Source: \"00000000-00006528.00000000.169509.000F4000.00000004.mdmp, 00000000-00006528.00000000.169509.009C0000.00000004.mdmp\")\n Found string \"s --no-sandbox --user-data-dir=\"C:\\Users\\1DSFVse\\AppData\\Roaming\\vibe-panel\" --gpu-preferences\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00006528.00000000.169509.00120000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"VibePanel1.0.0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Vibe Panel.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Vibe Panel.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; Source: \"00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.00304000.00000004.mdmp\")\n Found string \"HTTP2 ping cancelled\" (Indicator: \"ping\"; Source: \"00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.0047C000.00000004.mdmp\")\n Found string \"HTTP2 ping payload must be 8 bytes\" (Indicator: \"ping\"; Source: \"00000000-00006528.00000000.169509.00100000.00000004.mdmp, 00000000-00006528.00000000.169509.0047C000.00000004.mdmp\")\n Found string \"get hostname\" (Indicator: \"hostname\"; Source: \"00000000-00006528.00000000.169509.00304000.00000004.mdmp\")\n Found string \"set hostname\" (Indicator: \"hostname\"; Source: \"00000000-00006528.00000000.169509.00304000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Vibe Panel.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\"; Key: \"PRUNINGMODE\")\n \"Vibe Panel.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PROFILEENUMMODE\")\n \"Vibe Panel.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"ICMPROFILE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"VibePanel1.0.0.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005220)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005168)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00006528.00000000.169509.00100000.00000004.mdmp\n 00000000-00006528.00000000.169509.00110000.00000004.mdmp\n 00000000-00006528.00000000.169509.00430000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSecurityPrivilege\" (Indicator: \"SeSecurityPrivilege\"; Source: \"00000000-00005220.00000000.168176.746C2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"VibePanel1.0.0.exe\" opened \"\\Device\\KsecDD\"\n \"Vibe Panel.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"VibePanel1.0.0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"VibePanel1.0.0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"INTRANETNAME\"; Value: \"0100000000\")\n \"VibePanel1.0.0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0100000000\")\n \"VibePanel1.0.0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"AUTODETECT\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"libGLESv2.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections\"- Location: [%TEMP%\\nsjB68.tmp\\7z-out\\libGLESv2.dll]- [targetUID: 00000000-00005220]\n \"ffmpeg.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections\"- Location: [%TEMP%\\nsjB68.tmp\\7z-out\\ffmpeg.dll]- [targetUID: 00000000-00006528]\n \"libEGL.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections\"- Location: [%TEMP%\\nsjB68.tmp\\7z-out\\libEGL.dll]- [targetUID: 00000000-00005220]\n \"nsis7z.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nsjB68.tmp\\nsis7z.dll]- [targetUID: 00000000-00005220]\n \"elevate.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections\"- Location: [%TEMP%\\nsjB68.tmp\\7z-out\\resources\\elevate.exe]- [targetUID: 00000000-00005220]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsjB68.tmp\\System.dll]- [targetUID: 00000000-00005220]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"chrome_200_percent.pak has high entropy\"\n \"chrome_100_percent.pak has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"VibePanel1.0.0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"VibePanel1.0.0.exe\" at 00000000-00005220-00000C15-1622781118","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe\" launched with commandline \"/noconfig /fullpaths @\"%TEMP%\\\\mjhduqa3\\\\mjhduqa3.cmdline\"\" (UID: 00000000-00001672)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5168)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"Vibe Panel.exe\" called \"GetUserGeoID\" with parameters {\"GeoClass\": \"16\"}\n \"Vibe Panel.exe\" called \"GetGeoInfoW\" with parameters {\"Location\": \"244\"\n \"GeoType\": \"4\"\n \"lpGeoData\": \"5439573\"\n \"cchData\": \"3\"\n \"LangId\": \"0\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"VibePanel1.0.0.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\VibePanel1.0.0.exe\" queried ProcessMitigationPolicy\n \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe\" queried ProcessMitigationPolicy\n \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"VibePanel1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"VibePanel1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"VibePanel1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"VibePanel1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"VibePanel1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"VibePanel1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"VibePanel1.0.0.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"VibePanel1.0.0.exe\" writes archive file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsjB68.tmp\\app-64.7z\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"libGLESv2.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections\"- Location: [%TEMP%\\nsjB68.tmp\\7z-out\\libGLESv2.dll]- [targetUID: 00000000-00005220]\n \"ffmpeg.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 9 sections\"- Location: [%TEMP%\\nsjB68.tmp\\7z-out\\ffmpeg.dll]- [targetUID: 00000000-00006528]\n \"libEGL.dll\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 10 sections\"- Location: [%TEMP%\\nsjB68.tmp\\7z-out\\libEGL.dll]- [targetUID: 00000000-00005220]\n \"nsis7z.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\nsjB68.tmp\\nsis7z.dll]- [targetUID: 00000000-00005220]\n \"elevate.exe\" has type \"PE32 executable for MS Windows 6.00 (console) Intel i386 6 sections\"- Location: [%TEMP%\\nsjB68.tmp\\7z-out\\resources\\elevate.exe]- [targetUID: 00000000-00005220]\n \"System.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsjB68.tmp\\System.dll]- [targetUID: 00000000-00005220]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$4f","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to retrieve NetBIOS or DNS name associated with the local computer","description":"\"Vibe Panel.exe\" called \"GetComputerNameExW\" with parameters {\"NameType\": \"1\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-287","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to use Webdav for network","description":"Found string \"ystem.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00005220.00000000.168176.02780000.00000002.mdmp\")\n Found string \"System.WebDavPath\" (Indicator: \"webdav\"; Source: \"00000000-00005220.00000000.168176.02810000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-476","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"Network Related","name":"Reads the hosts file","description":"\"Vibe Panel.exe\" read 4096 bytes from file \"C:\\Windows\\System32\\drivers\\etc\\hosts\"","origin":"API Call","mitre_attack_id":"T1018","relevance":10,"id":"api-33","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to performs encryption on the data","description":"\"Vibe Panel.exe\" called \"CryptProtectData\" with parameters {\"pDataIn\": \"20000000aaaaaaaa90f33600ec100000\"\n \"szDataDescr\": \"d1e9bff052\"\n \"pDataOut\": \"160100000000000030c9a200c2020000\"\n \"$datain\": \"d91c68d0be1e4ab05d81190f0850f66ef8e5e4f6f7e3a2f0c30fcbfe910176fa\"\n \"$datadescr\": \"Chromium\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":5,"id":"api-171","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browsers sensitive information related strings","description":"\"C:\\Users\\1DSFVse\\AppData\\Roaming\\vibe-panel\\Local Storage\\leveldb/LOCK\" in Source: 00000000-00006528.00000000.169509.0002C000.00000004.mdmp\n \"C:\\Users\\1DSFVse\\AppData\\Roaming\\vibe-panel\\Local Storage\\leveldb\" in Source: 00000000-00006528.00000000.169509.0002C000.00000004.mdmp\n 00000000-00006528.00000000.169509.00094000.00000004.mdmp\n \"Roaming\\vibe-panel\\Local Storage\\leveldb\" in Source: 00000000-00006528.00000000.169509.00044000.00000004.mdmp\n \"1DSFVse\\AppData\\Roaming\\vibe-panel\\Local Storage\\leveldb/MANIFEST-000001\" in Source: 00000000-00006528.00000000.169509.00044000.00000004.mdmp\n \"Roaming\\vibe-panel\\Local Storage\\leveldb\\\" in Source: 00000000-00006528.00000000.169509.00094000.00000004.mdmp\n \"s\\1DSFVse\\AppData\\Roaming\\vibe-panel\\Local Storage\\leveldb/MANIFEST-000001\" in Source: 00000000-00006528.00000000.169509.00094000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1005","relevance":3,"id":"string-133","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access browsers/wallets sensitive information (file access)","description":"$50","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-132","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"VibePanel1.0.0.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nseB48.tmp\" with delete access\n \"VibePanel1.0.0.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsjB68.tmp\" with delete access\n \"Vibe Panel.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\vibe-panel\\Code Cache\\js\\index-dir\\the-real-index\" with delete access\n \"Vibe Panel.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\vibe-panel\\Code Cache\\wasm\\index-dir\\the-real-index\" with delete access\n \"Vibe Panel.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\vibe-panel\\Code Cache\\wasm\\index-dir\\temp-index\" with delete access\n \"Vibe Panel.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\vibe-panel\\Code Cache\\js\\index-dir\\temp-index\" with delete access\n \"Vibe Panel.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\vibe-panel\\Local Storage\\leveldb\\CURRENT\" with delete access\n \"Vibe Panel.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\vibe-panel\\Local Storage\\leveldb\\000001.dbtmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"VibePanel1.0.0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"VibePanel1.0.0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"$51","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"VibePanel1.0.0.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe\" (Handle: 1344)\n \"VibePanel1.0.0.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe\" (Handle: 1344)\n \"Vibe Panel.exe\" wrote 000011C0 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 2012)\n \"Vibe Panel.exe\" wrote 00000008 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 2012)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"malicious","category":"System Security","name":"Executes powershell requesting to bypass execution policy","description":"Process \"powershell.exe\" with commandline \"-NoProfile -ExecutionPolicy Bypass -File %TEMP%\\\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\\\resources\\\\app\\\\helper\\\\run.ps1\" (UID: 00000000-00005168)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-29","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$52","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2017692745729', 'hResInfo': '2017692754144'}\" (UID: 00000000-00003996)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2017692745729', 'hResInfo': '2017692754176'}\" (UID: 00000000-00003996)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2017692745729', 'hResInfo': '2017692754192'}\" (UID: 00000000-00003996)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2017692745729', 'hResInfo': '2017692754160'}\" (UID: 00000000-00003996)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000464.00000000.246461.02800000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003996.00000001.250287.C7DC0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - %TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\.\\.\\vk_swiftshader.dll; Source: \"00000000-00006424-00000C2B-2359998835\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Vibe Panel.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp, 00000000-00000464.00000002.250302.739C4000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp, 00000000-00000464.00000002.250302.739C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00000464.00000000.246461.007A0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00003996.00000000.248369.AD430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00000464.00000000.246461.007A0000.00000004.mdmp\")\n Found api reference \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp, 00000000-00000464.00000002.250302.739C4000.00000002.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00003996.00000000.248369.AD430000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00003996.00000000.248369.AD430000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp, 00000000-00000464.00000002.250302.739C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp, 00000000-00000464.00000002.250302.739C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003996.00000001.250287.628B0000.00000004.mdmp\")\n Found string \"psrsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003996.00000001.250287.62940000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp, 00000000-00000464.00000002.250302.739C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp, 00000000-00000464.00000002.250302.739C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"System.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00000464.00000001.248382.08010000.00000002.mdmp\")\n Found string \"ystem.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00000464.00000002.250302.02B10000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Vibe Panel.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006940)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Vibe Panel.exe\" called \"GetActiveWindow\" (UID: 00000000-00006940)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a000000000000005d58000002000000007f00000000000000000000e08e86c7d5010000c0fbeeccf87f00000001000000000000b8fbeeccf87f0000000000000000000080cbb7eff87f000000000000000000000001000000000000000000000000000000000000000000000100000000000000df1aeeccf87f00000000000000000000b8fbeeccf87f000000000000 (UID: 00000000-00003996)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003996)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003996)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00003996.00000000.248369.AD430000.00000004.mdmp\n 00000000-00003996.00000001.250287.AD430000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00000464.00000000.246461.0041E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$53","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003996)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$54","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mulder2@gmx.de\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) vibe-panel/1.0.0 Chrome/130.0.6723.191 Electron/33.4.11 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00000916.00000000.249474.0004C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at E0610000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003996.00000001.250287.628D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Found reference to API \"2004-2018 LoRd_MuldeR \" (Indicator: \"@gmx.\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"2004-2018 lord_mulder \" [Source: 00000000-00000464.00000001.248382.0041E000.00000004.mdmp]\n Observed email domain:\"copyright (c) 2004-2018 lord_mulder \" [Source: 00000000-00000464.00000001.248382.0041E000.00000004.mdmp\n 00000000-00000464.00000001.248382.739CA000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"C:\\WINDOWS\\system32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00000916.00000000.249474.0004C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00003996\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00003996\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$55","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000916.00000000.249474.11710000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00003996.00000001.250287.628D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"5,,RtlGetNtProductType,NTDLL.dll,\"01:04:10.9\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00000464.00000000.246461.007A0000.00000004.mdmp\n 00000000-00000464.00000001.248382.007A0000.00000004.mdmp\n 00000000-00000464.00000002.250302.007A0000.00000004.mdmp\"), Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\n 00000000-00000464.00000002.250302.739C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003996)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003996)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000464.00000001.248382.0041E000.00000004.mdmp, 00000000-00000464.00000002.250302.739C4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000464.00000000.246461.02800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00000916.00000000.249474.11710000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Vibe Panel.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\"; Value: \"ECBCE82C786DDD010000000000000000000000000200000000\")\n \"Vibe Panel.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"Device\\HarddiskVolume3\\DosDevices\\C:\\??\\Volume{44294f7c-6083-41c6-8176-3c202d755616}\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00000464.00000000.246461.007A0000.00000004.mdmp, 00000000-00000464.00000001.248382.007A0000.00000004.mdmp, 00000000-00000464.00000002.250302.007A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00000916.00000000.249474.11710000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00000916.00000000.249474.11710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"System Security","name":"Deletes registry keys","description":"\"Vibe Panel.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SPELLING\\DICTIONARIES\"; Key: \"NEUTRAL\"; Value: \"\")\n \"Vibe Panel.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SPELLING\\DICTIONARIES\"; Key: \"EN-US\"; Value: \"\")\n \"Vibe Panel.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SPELLING\\DICTIONARIES\"; Key: \"EN\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$56","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Script loads executable in memory (Antimalware Scan Interface)","description":"$57","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1055.001","relevance":10,"id":"amsi-3","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]}],"intel_graph":{"map":{"File:10f381082d99896c03e33f5fda9dc8fd31986d4e775359bce82c79564112f8e1":{"type":"File","value":"10f381082d99896c03e33f5fda9dc8fd31986d4e775359bce82c79564112f8e1"},"File:2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6":{"type":"File","value":"2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6"},"File:3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39":{"type":"File","value":"3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39"},"File:3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca":{"type":"File","value":"3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:3ebbae94ff8722d3e87e27cf4ec630a07d18ae241a2187e4314460073f46f549":{"type":"File","value":"3ebbae94ff8722d3e87e27cf4ec630a07d18ae241a2187e4314460073f46f549"},"File:49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c":{"type":"File","value":"49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c"},"File:4f123245b062d71d56819ac1198d13a3d7953decd4491fca0fbd22c5e129c3bd":{"type":"File","value":"4f123245b062d71d56819ac1198d13a3d7953decd4491fca0fbd22c5e129c3bd"},"File:4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc":{"type":"File","value":"4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc"},"File:5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d":{"type":"File","value":"5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d"},"File:5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d":{"type":"File","value":"5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d"},"File:7097807002c2d20a9757c0d4f9e681c1fde93e10b85314cd81faa76d71001282":{"type":"File","value":"7097807002c2d20a9757c0d4f9e681c1fde93e10b85314cd81faa76d71001282"},"File:75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82":{"type":"File","value":"75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82"},"File:817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc":{"type":"File","value":"817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc"},"File:9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37":{"type":"File","value":"9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37"},"File:a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c":{"type":"File","value":"a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c"},"File:b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592":{"type":"File","value":"b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592","verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","File has very high prevalence"]},"filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e":{"type":"File","value":"b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]},"filetype":"PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d":{"type":"File","value":"b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d"},"File:bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89":{"type":"File","value":"bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89"},"File:c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7":{"type":"File","value":"c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7"},"File:d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220":{"type":"File","value":"d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220"},"File:db040e9f17d2792801c07a7bb3ac96c21d8189c98e9ab34210c5888b2ee53aa1":{"type":"File","value":"db040e9f17d2792801c07a7bb3ac96c21d8189c98e9ab34210c5888b2ee53aa1"},"File:e32681cdd03db28eb360b1b4203c2988190b7b6f77679ca807cd95a1967ded04":{"type":"File","value":"e32681cdd03db28eb360b1b4203c2988190b7b6f77679ca807cd95a1967ded04"},"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730":{"type":"File","value":"e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83":{"type":"File","value":"f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83"}},"chains":[{"id":"1568034754345646817","root":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca"}],"verdict":{"verdict":"unknown"}},{"id":"1568034754354035426","root":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592"}],"verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"1568034754358229731","root":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e"}],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"sandbox_files","root":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","edges":[{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:10f381082d99896c03e33f5fda9dc8fd31986d4e775359bce82c79564112f8e1"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:3ebbae94ff8722d3e87e27cf4ec630a07d18ae241a2187e4314460073f46f549"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:7097807002c2d20a9757c0d4f9e681c1fde93e10b85314cd81faa76d71001282"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:e32681cdd03db28eb360b1b4203c2988190b7b6f77679ca807cd95a1967ded04"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:db040e9f17d2792801c07a7bb3ac96c21d8189c98e9ab34210c5888b2ee53aa1"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:4f123245b062d71d56819ac1198d13a3d7953decd4491fca0fbd22c5e129c3bd"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7"},{"edge_kind":"extracted","from_key":"File:e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","to_key":"File:b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":69,"imported_dlls_count":171,"dropped_files_count":0,"extracted_files_count":24,"files_written_count":338,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6aed084e30f0e584a1081c1d","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"submit_name":"Vibe Panel 1.0.0.exe","analysis_start_time":"2026-11-05T22:51:04+00:00","indicators_count":{"informative":165,"suspicious":34,"malicious":3},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"6aed0826307cd505320644fe","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"submit_name":"Vibe Panel 1.0.0.exe","analysis_start_time":"2026-11-05T22:50:24+00:00","indicators_count":{"informative":206,"suspicious":43,"malicious":4},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}],"processes":[{"pid":464,"ppid":0,"name":"VibePanel1.0.0.exe","command_line":"","sha256":"e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730","normalized_path":"C:\\VibePanel1.0.0.exe","uid":"00000000-00000464","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB9UlEQVR4XsXXS0sbURgG4G/R2pjLOE4u5manGi+JQSISikQsKIgKWXbRRaFILztxobZeEHTjH+imdFlw7cKNC0WoUURa8BeIe/elqPA2J/ZMJ+ekcSYmmYGHMO85zPtNZnWIhGvl+Bb6cB6dg1N196lwA7HPuNbOgNGZWcTTkw23eoLyQVh5LDVR0ebexYOIz+PWjk1DRJLjqIfh8VdSVk2pnH2XSPJFzbY+b0uZVR8L16BoegLhvjHHULgnBydRqHsETqJQ13M4iQJ6Fo1SOL+UMhFpT4cgmn75QcoahdrjGTiJtNggrFj/CYO4ZmePiJSOfqjRtEFP5cruOfPDxTU7e8xYNymhXqiRpCVlBTbW/od1ky/YA4ZNcx9ziZ21SnhvcYBucEooca+yoipZNeZO8ga6UIkaHajozdejf3/134zfL+xfSfs58fkcef3PYJf5jc3EfVaQR9NhVyb/Xiofe7cp7bOCPO2dqIU4gLjOZEenpUxEbjWOWvFyJZiQ1qwid1sMteIDiLlo9+CHlHHUqkTRDIpflzKmOEAY1aQyOSmrJ3L5OmDV67fzUvZQ9MQbRLPMLW2Ufr982zEyWj66Rosn4Iil77/vzgYtbj+cYJyMlotntcetWlNJ58PVUzaE2hRSufli3+WRq60hFg9/ScV/AAUFvmgnX3lWAAAAAElFTkSuQmCC"},{"pid":6940,"ppid":464,"name":"Vibe Panel.exe","command_line":"","sha256":"89881f82e9e67a108307de46dcf0f1d6b67aa168a507d0b3f1157f3bc478af32","normalized_path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe","parent_uid":"00000000-00000464","uid":"00000000-00006940"},{"pid":3996,"ppid":6940,"name":"powershell.exe","command_line":"-NoProfile -ExecutionPolicy Bypass -File %TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app\\helper\\run.ps1","sha256":"d436e66c0d092508e4b85290815ab375695fa9013c7423a3a27fed4f1acf90bd","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006940","uid":"00000000-00003996"},{"pid":3552,"ppid":3996,"name":"csc.exe","command_line":"/noconfig /fullpaths @\"%TEMP%\\zeusxdz5\\zeusxdz5.cmdline\"","sha256":"a725546bde53f1ad533e74abb01dd5ed5f07b171f5c284738da88f6ce478cf5f","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe","parent_uid":"00000000-00003996","uid":"00000000-00003552"},{"pid":5708,"ppid":3552,"name":"cvtres.exe","command_line":"/NOLOGO /READONLY /MACHINE:IX86 \"/OUT:%TEMP%\\RES6840.tmp\" \"%TEMP%\\zeusxdz5\\CSCC20BABBBD43C47D49C6046EA93BEA9AB.TMP\"","sha256":"fd3ef1b4c91b2e85ccd05724a7cd527a3a27d7d549b0dcdb70d3d78be120c560","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\cvtres.exe","parent_uid":"00000000-00003552","uid":"00000000-00005708"},{"pid":6424,"ppid":6940,"name":"Vibe Panel.exe","command_line":"\"%APPDATA%\\vibe-panel\" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1732,i,10420271883954740597,7838506156379402215,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:2","sha256":"89881f82e9e67a108307de46dcf0f1d6b67aa168a507d0b3f1157f3bc478af32","normalized_path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe","parent_uid":"00000000-00006940","uid":"00000000-00006424"},{"pid":916,"ppid":6940,"name":"Vibe Panel.exe","command_line":"\"%APPDATA%\\vibe-panel\" --field-trial-handle=3012,i,10420271883954740597,7838506156379402215,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:11","sha256":"89881f82e9e67a108307de46dcf0f1d6b67aa168a507d0b3f1157f3bc478af32","normalized_path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe","parent_uid":"00000000-00006940","uid":"00000000-00000916"},{"pid":4620,"ppid":6940,"name":"Vibe Panel.exe","command_line":"\"%APPDATA%\\vibe-panel\" --app-path=\"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app\" --no-sandbox --no-zygote --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1793915205019692 --launch-time-ticks=3893085680 --field-trial-handle=3156,i,10420271883954740597,7838506156379402215,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1","sha256":"89881f82e9e67a108307de46dcf0f1d6b67aa168a507d0b3f1157f3bc478af32","normalized_path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe","parent_uid":"00000000-00006940","uid":"00000000-00004620"},{"pid":6972,"ppid":6940,"name":"Vibe Panel.exe","command_line":"\"%APPDATA%\\vibe-panel\" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3192,i,10420271883954740597,7838506156379402215,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:10","sha256":"89881f82e9e67a108307de46dcf0f1d6b67aa168a507d0b3f1157f3bc478af32","normalized_path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe","parent_uid":"00000000-00006940","uid":"00000000-00006972"}],"all_imported_dlls":["sechost.dll","userenv.dll","version.dll","VxSSL64.dll","Windows.FileExplorer.Common.dll","powrprof.dll","dwmapi.dll","windows.storage.dll","OneCoreUAPCommonProxyStub.dll","System.Management.Automation.ni.dll","wow64win.dll","ucrtbase.dll","oleaut32.dll","oleacc.dll","shfolder.dll","WindowsCodecs.dll","BCP47Langs.dll","comctl32.dll","ffmpeg.dll","msasn1.dll","mscms.dll","MsSpellCheckingFacility.dll","mscoree.dll","user32.dll","atl.dll","System.ni.dll","uxtheme.dll","cryptbase.dll","bcrypt.dll","dhcpcsvc6.dll","InputHost.dll","sspicli.dll","coloradapterclient.dll","wow64cpu.dll","System.Core.ni.dll","imm32.dll","fltLib.dll","shlwapi.dll","dbgcore.dll","wtsapi32.dll","clr.dll","msvcp_win.dll","apphelp.dll","WinTypes.dll","winmm.dll","MMDevAPI.dll","ucrtbase_clr0400.dll","gdi32full.dll","clbcatq.dll","profapi.dll","srvcli.dll","ntdll.dll","win32u.dll","nsis7z.dll","iertutil.dll","devobj.dll","cryptsp.dll","IPHLPAPI.DLL","mswsock.dll","rsaenh.dll","msvcrt.dll","SHCore.dll","DWrite.dll","umpdc.dll","WindowManagementAPI.dll","advapi32.dll","crypt32.dll","nlaapi.dll","Windows.UI.dll","twinapi.appcore.dll","mscoreei.dll","gdi32.dll","setupapi.dll","IconCodecService.dll","dbghelp.dll","ws2_32.dll","KernelBase.dll","rpcrt4.dll","VxSSL32.dll","winhttp.dll","wldp.dll","netutils.dll","ntshrui.dll","dhcpcsvc.dll","mscorlib.ni.dll","vcruntime140.dll","nsi.dll","combase.dll","msvcp140.dll","System.dll","secur32.dll","dnsapi.dll","vcruntime140_clr0400.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","kernel32.dll","propsys.dll","TextInputFramework.dll","vcruntime140_1.dll","CoreUIComponents.dll","KBDUS.DLL","CoreMessaging.dll","wow64.dll","ole32.dll","cfgmgr32.dll","wintrust.dll","msctf.dll","kernel.appcore.dll","bcryptprimitives.dll","urlmon.dll","StdUtils.dll","dpapi.dll","shell32.dll","ntmarta.dll","Windows.StateRepositoryPS.dll","psapi.dll","System.Configuration.Install.ni.dll","imagehlp.dll","libEGL.dll","atlthunk.dll","System.Configuration.ni.dll","d3dcompiler_47.dll","wow64con.dll","netprofm.dll","ResourcePolicyClient.dll","Windows.System.Launcher.dll","clrjit.dll","msvcp110_win.dll","winsta.dll","mscorpehost.dll","gpapi.dll","amsi.dll","MpClient.dll","mfplat.dll","Microsoft.PowerShell.Security.ni.dll","directmanipulation.dll","System.Data.dll","System.Transactions.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","libGLESv2.dll","alink.dll","mf.dll","twinapi.dll","vcruntime140_1_clr0400.dll","wshext.dll","vk_swiftshader.dll","nlansp_c.dll","DXCore.dll","System.Data.ni.dll","Windows.StateRepositoryCore.dll","System.Transactions.dll","msisip.dll","System.Management.ni.dll","dxgi.dll","RTWorkQ.dll","rasadhlp.dll","AppxSip.dll","MpOAV.dll","yNRzMme6.dll","wow64base.dll","Windows.Globalization.dll","dcomp.dll","npmproxy.dll","pwrshsip.dll","Windows.StateRepositoryClient.dll","Microsoft.Management.Infrastructure.ni.dll","System.DirectoryServices.ni.dll","directxdatabasehelper.dll","vulkan-1.dll","System.Xml.ni.dll","DataExchange.dll","ExplorerFrame.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"LICENSE.electron.txt","sha256":"5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"bg.pak","sha256":"f08de6909faf88465c28388aa03fdf08e165866a5a23c738ed33382275c4ec83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"chrome_200_percent.pak","sha256":"2c1b3e4b8a0cf837ae0a390fca54f45d7d22418e040f1dfea979622383acced6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"libGLESv2.dll","sha256":"10f381082d99896c03e33f5fda9dc8fd31986d4e775359bce82c79564112f8e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"en-GB.pak","sha256":"3bf7e7e02c40dac55ce9bd5b4789eaa99e57271b2d907a5ce2ca90b979a58c39","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"ca.pak","sha256":"bc2b7d6a769c69b27a81cc09a1babd4ccaf003fae32f8294a38e498f2c529c89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"System.dll","sha256":"3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"icudtl.dat","sha256":"3ebbae94ff8722d3e87e27cf4ec630a07d18ae241a2187e4314460073f46f549","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"elevate.exe","sha256":"9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"LICENSES.chromium.html","sha256":"7097807002c2d20a9757c0d4f9e681c1fde93e10b85314cd81faa76d71001282","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"nsis7z.dll","sha256":"b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592","verdict":"clean","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"en-US.pak","sha256":"75db989561e145d0d990c4918502316c77ce66b344d3dce4739e3a6db43fde82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"ffmpeg.dll","sha256":"4fcdedbc68eae4b4cfe0eed275316fdf66c9d4a57a98d29a77d0e8f4149cfcbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"$$PLUGINSDIR/StdUtils.dll","sha256":"b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"libEGL.dll","sha256":"d9d2f5b5fae60a63523f92c07539dd93893ff7d9ffa41f0bb57caca4be9f2220","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"da.pak","sha256":"e32681cdd03db28eb360b1b4203c2988190b7b6f77679ca807cd95a1967ded04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"ar.pak","sha256":"817829ad75dbc7d59b5042d7f056fa2485f82d1ae2af50ed83fd89f86f3d58fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"chrome_100_percent.pak","sha256":"a659ee9eb38636f85f5336587c578fb29740d3effaff9b92852c8a210e92978c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"am.pak","sha256":"49a2095ad9ffac0b7ffaadba64d2c2b51a05e0695e21d1c428735485757bd11c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"bn.pak","sha256":"5a57265ebac6df683f0279684909755ad71ea70fea71c6ecc1810eac61d1cb3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"cs.pak","sha256":"db040e9f17d2792801c07a7bb3ac96c21d8189c98e9ab34210c5888b2ee53aa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"de.pak","sha256":"4f123245b062d71d56819ac1198d13a3d7953decd4491fca0fbd22c5e129c3bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"af.pak","sha256":"c56cb2841ee2e40fbdd6b7e293a1ce74bd10fd500465fcf99d1e07f8d69f8ce7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"el.pak","sha256":"b8707f2511c4ec5533077009771f3aa92b0fb5b395b13907f5860a9151b2431d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nseB48.tmp","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsjB68.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\app-64.7z","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\nsis7z.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\app","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\elevate.exe","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\d3dcompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\ffmpeg.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\af.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\am.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\ar.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\bg.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\bn.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\ca.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\cs.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\da.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\de.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\el.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\en-GB.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\es.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\et.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\fa.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\fi.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\fil.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\fr.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\gu.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\he.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\hi.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\hr.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\hu.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\id.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\it.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\ja.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\kn.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\ko.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\lt.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\lv.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\ml.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\mr.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\ms.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\nb.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\nl.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\pl.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\ro.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\ru.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\sk.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\sl.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\sr.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\sv.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\sw.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\ta.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\te.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\th.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\tr.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\uk.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\ur.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\vi.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\locales\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\app\\helper","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\app\\helper\\AudioHelper.cs","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\app\\helper\\run.ps1","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\app\\main.js","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\app\\package.json","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\app\\preload.js","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\app\\ui","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\app\\ui\\app.js","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\app\\ui\\index.html","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources\\app\\ui\\style.css","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\resources.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\Vibe Panel.exe","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\nsjB68.tmp\\7z-out\\vulkan-1.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\d3dcompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\ffmpeg.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\Vibe Panel.exe","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\vulkan-1.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\af.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\am.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\ar.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\bg.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\bn.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\ca.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\cs.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\da.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\de.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\el.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\en-GB.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\es.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\et.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\fa.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\fi.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\fil.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\fr.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\gu.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\he.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\hi.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\hr.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\hu.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\id.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\it.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\ja.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\kn.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\ko.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\lt.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\lv.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\ml.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\mr.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\ms.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\nb.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\nl.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\pl.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\ro.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\ru.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\sk.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\sl.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\sr.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\sv.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\sw.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\ta.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\te.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\th.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\tr.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\uk.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\ur.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\vi.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\locales\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\elevate.exe","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app\\main.js","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app\\package.json","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app\\preload.js","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app\\helper\\AudioHelper.cs","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app\\helper\\run.ps1","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app\\ui\\app.js","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app\\ui\\index.html","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\3Lhs95VwVDmnypCbYl7p0o9fgvJ\\resources\\app\\ui\\style.css","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsjB68.tmp\\StdUtils.dll","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%APPDATA%\\vibe-panel\\lockfile","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"pipe\\mojo.6528.1492.13208473225510608037","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Local Storage\\leveldb\\LOG","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Local Storage\\leveldb\\LOCK","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"pipe\\uv\\FFFFFFFFFFFFFFFF-6528","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"pipe\\uv\\0000000000000000-6528","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"pipe\\uv\\0000000000000001-6528","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%APPDATA%\\vibe-panel\\Network\\NetworkDataMigrated","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Code Cache","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"path":"%APPDATA%\\vibe-panel\\Code Cache\\js\\index","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Code Cache\\wasm\\index","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Code Cache\\wasm\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Code Cache\\js\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Local Storage\\leveldb\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Local Storage\\leveldb\\000001.dbtmp","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nspB7AD.tmp","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\app-64.7z","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\nsis7z.dll","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\app","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\elevate.exe","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\d3dcompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\ffmpeg.dll","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\af.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\am.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\ar.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\bg.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\bn.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\ca.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\cs.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\da.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\de.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\el.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\en-GB.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\es.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\et.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\fa.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\fi.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\fil.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\fr.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\gu.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\he.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\hi.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\hr.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\hu.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\id.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\it.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\ja.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\kn.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\ko.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\lt.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\lv.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\ml.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\mr.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\ms.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\nb.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\nl.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\pl.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\ro.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\ru.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\sk.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\sl.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\sr.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\sv.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\sw.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\ta.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\te.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\th.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\tr.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\uk.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\ur.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\vi.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\locales\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\app\\helper","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\app\\helper\\AudioHelper.cs","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\app\\helper\\run.ps1","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\app\\main.js","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\app\\package.json","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\app\\preload.js","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\app\\ui","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\app\\ui\\app.js","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\app\\ui\\index.html","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources\\app\\ui\\style.css","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\resources.pak","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\Vibe Panel.exe","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\7z-out\\vulkan-1.dll","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\nsuB81B.tmp\\StdUtils.dll","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"pipe\\mojo.6940.5328.4146065390938058988","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"pipe\\uv\\FFFFFFFFFFFFFFFF-6940","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"pipe\\uv\\0000000000000000-6940","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"pipe\\uv\\0000000000000001-6940","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Local Storage\\leveldb\\000003.log","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\GPUCache\\index","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\GPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\GPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\GPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\GPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\DawnWebGPUCache\\index","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\Microsoft\\Spelling\\en-US\\default.exc","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\Microsoft\\Spelling\\en-US\\default.acl","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\DawnWebGPUCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\DawnWebGPUCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\DawnWebGPUCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\DawnWebGPUCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\DawnGraphiteCache\\index","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\DawnGraphiteCache\\data_0","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\DawnGraphiteCache\\data_1","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\DawnGraphiteCache\\data_2","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\DawnGraphiteCache\\data_3","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"pipe\\mojo.6940.5328.10552605454571207844","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\d5b89562-06fa-4b3e-9200-0ef269f88978.tmp","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\9afc0978-e8aa-4486-80b1-057c974626f2.tmp","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"pipe\\mojo.6940.5328.9927053106934683442","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"pipe\\mojo.6940.1676.13582848620033161665","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\defb7a26-d353-4fe0-827b-5b2d76ae1f0f.tmp","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_kt4bo4ml.ja0.ps1","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ftnqs4ug.xhi.psm1","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\zeusxdz5\\zeusxdz5.tmp","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\zeusxdz5\\zeusxdz5.0.cs","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\zeusxdz5\\zeusxdz5.dll","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\zeusxdz5\\zeusxdz5.cmdline","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\zeusxdz5\\zeusxdz5.out","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%TEMP%\\zeusxdz5\\zeusxdz5.err","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Shared Dictionary\\cache\\index","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Shared Dictionary\\db","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Shared Dictionary\\db-journal","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Shared Dictionary\\cache\\index-dir\\temp-index","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Network\\Trust Tokens","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Network\\Trust Tokens-journal","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"path":"%APPDATA%\\vibe-panel\\Network\\b44e7dde-30e2-4115-bf69-9f6506bbb357.tmp","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5220:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5220:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5220:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5220:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"Local\\SM0:5220:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"Local\\SM0:5220:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"SM0:5220:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"SM0:5220:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\vibe-panelProcessSingletonStartup","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6528:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"Local\\SM0:6528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"SM0:6528:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"vibe-panelProcessSingletonStartup","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"},{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:6528:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5168:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"SM0:5168:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"SM0:5168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"Local\\SM0:5168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed084e30f0e584a1081c1d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:464:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:464:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:464:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:464:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:464:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"Local\\SM0:464:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"Local\\SM0:464:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:464:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"Local\\SM0:6940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:6940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:6940:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6940:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6940:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3996:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3996:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"Local\\SM0:3996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:3996:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"Local\\SM0:3996:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:3996:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:3552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:5708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"Local\\SM0:6424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:6424:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"Local\\SM0:916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:916:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:916:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:916:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4620:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4620:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"Local\\SM0:4620:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]},{"name":"SM0:4620:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed0826307cd505320644fe"}]}]}},"report_ids":{"sandbox_job_ids":["6aed0826307cd505320644fe","6aed084e30f0e584a1081c1d"]}}}]]}] 2c:[["$","title","0",{"children":"Suspicious Sample e4fda2d16d8d… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample e4fda2d16d8d…. Threat score 35/100. 0/26 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample e4fda2d16d8d… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample e4fda2d16d8d…. Threat score 35/100. 0/26 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e4fda2d16d8d1318985607f5fb7572d163aa3358db424d0bf08e6af683bc1730"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample e4fda2d16d8d… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample e4fda2d16d8d…. Threat score 35/100. 0/26 AV engines flagged this file. 4 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L58","11",{}]] 32:null