24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 82:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T421,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample f513d53266e4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f513d53266e4…. Threat score 100/100. 0/24 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970"],"about":{"@type":"SoftwareApplication","name":"Setup.exe","applicationCategory":["peexe","executable"],"identifier":"f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":9,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1fcd,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "SysAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperBuffW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SignalObjectAndWait"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetSearchPathMode"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardType"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "SysFreeString"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "EnumCalendarInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "sample.bin"), Found reference to API (Indicator: "SysReAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadLocale"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin")26:T478,"Setup.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00003816) "Setup.tmp" called "FindResourceW" with parameter "43285932" - (UID: 00000000-00007116) "Setup.tmp" called "FindResourceW" with parameter "43253540" - (UID: 00000000-00007116) "Setup.tmp" called "FindResourceW" with parameter "43405708" - (UID: 00000000-00007116) "Setup.tmp" called "FindResourceW" with parameter "43286316" - (UID: 00000000-00007116) "Setup.tmp" called "FindResourceW" with parameter "43256940" - (UID: 00000000-00007116) "Setup.tmp" called "FindResourceW" with parameter "43286460" - (UID: 00000000-00007116) "Setup.tmp" called "FindResourceW" with parameter "43257180" - (UID: 00000000-00007116) "Setup.tmp" called "FindResourceW" with parameter "43293324" - (UID: 00000000-00007116) "Setup.tmp" called "FindResourceW" with parameter "43269380" - (UID: 00000000-00007116) "Setup.tmp" called "FindResourceW" with parameter "43406044" - (UID: 00000000-00007116) "Start.exe" called "FindResourceW" with parameter "3585" - (UID: 00000000-00001192) "Start.exe" called "FindResourceW" with parameter "3585" - (UID: 00000000-00001704)27:T43c,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "is-43FPG.tmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "is-43FPG.tmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp")28:Te03,"Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-NB28T.tmp" to "C:\inetpub\PassFab iPhone Unlocker\unins000.exe" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\config\is-47LI0.tmp" to "C:\inetpub\PassFab iPhone Unlocker\config\log.config" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-BDITL.tmp" to "C:\inetpub\PassFab iPhone Unlocker\PassFab iPhone Unlocker.exe" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-G3UF9.tmp" to "C:\inetpub\PassFab iPhone Unlocker\AppService.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-FERRI.tmp" to "C:\inetpub\PassFab iPhone Unlocker\BsSndRpt.exe" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-F98U6.tmp" to "C:\inetpub\PassFab iPhone Unlocker\BugSplat.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-HDL5L.tmp" to "C:\inetpub\PassFab iPhone Unlocker\BugSplatDotNet.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-K7GE7.tmp" to "C:\inetpub\PassFab iPhone Unlocker\BugSplatRc.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-G7N9B.tmp" to "C:\inetpub\PassFab iPhone Unlocker\TSMonitorCLR.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-KRQ23.tmp" to "C:\inetpub\PassFab iPhone Unlocker\deviceModules.json" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-COIK5.tmp" to "C:\inetpub\PassFab iPhone Unlocker\DllWrapper.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-D0ATO.tmp" to "C:\inetpub\PassFab iPhone Unlocker\Downloader.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-QLVQ0.tmp" to "C:\inetpub\PassFab iPhone Unlocker\EntityFramework.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-90P4E.tmp" to "C:\inetpub\PassFab iPhone Unlocker\EntityFramework.SqlServer.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-4KKAU.tmp" to "C:\inetpub\PassFab iPhone Unlocker\FileReport.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-57J6K.tmp" to "C:\inetpub\PassFab iPhone Unlocker\Fukey.exe.config" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-UO7PA.tmp" to "C:\inetpub\PassFab iPhone Unlocker\ICSharpCode.SharpZipLib.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-LKQ00.tmp" to "C:\inetpub\PassFab iPhone Unlocker\IosManager.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-53LFN.tmp" to "C:\inetpub\PassFab iPhone Unlocker\iTunesEnvFitCLR.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-M495I.tmp" to "C:\inetpub\PassFab iPhone Unlocker\libcurl.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-366N1.tmp" to "C:\inetpub\PassFab iPhone Unlocker\log4net.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-VMA3H.tmp" to "C:\inetpub\PassFab iPhone Unlocker\Microsoft.Expression.Drawing.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-F4HC9.tmp" to "C:\inetpub\PassFab iPhone Unlocker\Microsoft.Windows.Shell.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-5IDBB.tmp" to "C:\inetpub\PassFab iPhone Unlocker\Newtonsoft.Json.dll" "Setup.tmp" renamed original file"C:\inetpub\PassFab iPhone Unlocker\is-2KN6R.tmp" to "C:\inetpub\PassFab iPhone Unlocker\PresentationFramework.Aero2.dll"29:Tc78,Assembly shows XOR instruction xor al 41h in Stream UID: 00000000-00007116-64710-1-0050037C Assembly shows XOR instruction xor al FFh in Stream UID: 00000000-00007116-64710-1-0050037C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007116-64710-175-004AEA0C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007116-64710-440-004D6940 Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00007116-64710-966-004AB434 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00007116-64710-966-004AB434 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007116-64710-1096-004CF440 Assembly shows XOR instruction xor al byte ptr [edi+00h] in Stream UID: 00000000-00007116-64710-1570-004816E0 Assembly shows XOR instruction xor al 47h in Stream UID: 00000000-00007116-64710-1570-004816E0 Assembly shows XOR instruction xor eax 34B80047h in Stream UID: 00000000-00007116-64710-1570-004816E0 Assembly shows XOR instruction xor eax dword ptr [esi+00h] in Stream UID: 00000000-00007116-64710-1570-004816E0 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00007116-64710-1598-004336A4 Assembly shows XOR instruction xor ah 01h in Stream UID: 00000000-00007116-64710-1777-004576E6 Assembly shows XOR instruction xor byte ptr [ebx] 41h in Stream UID: 00000000-00007116-64710-2610-00413398 Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00007116-64710-2610-00413398 Assembly shows XOR instruction xor al byte ptr [ebp-01h] in Stream UID: 00000000-00007116-64710-2659-004137B0 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00007116-64710-3097-0042A928 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00007116-64710-3176-00434448 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00007116-64710-3231-00435ECC Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007116-64710-3314-0047D3DC Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00007116-64710-3517-00458B5C Assembly shows XOR instruction xor al byte ptr [edx+000000B8h] in Stream UID: 00000000-00007116-64710-3533-004587A4 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007116-64710-3936-00472CF4 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007116-64710-3964-00474840 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007116-64710-4073-0047C4DC Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00007116-64710-4539-004B8190 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007116-64710-4539-004B8190 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007116-64710-4667-004C472C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007116-64710-4727-004CA018 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00007116-64710-4813-004E06F4 Assembly shows XOR instruction xor esi 02h in Stream UID: 00000000-00007116-64710-4898-004E4810 Assembly shows XOR instruction xor eax C37BCAAEh in Stream UID: 00000000-00007116-64710-5219-00403D072a:T57d,Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "Setup.exe") Found reference to API "CryptAcquireContextA" (Indicator: "CryptAcquireContext"; File: "Setup.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "Setup.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "Setup.exe") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "Setup.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "Setup.exe") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "Setup.exe") Found reference to API "CertAddEncodedCertificateToStore" (Indicator: "CertAddEncodedCertificateToStore"; File: "Setup.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "Setup.exe") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "Setup.exe") Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; File: "Setup.exe") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "Setup.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "Setup.exe") Found reference to API "CryptProtectData" (Indicator: "CryptProtectData"; File: "Setup.exe")2b:T573,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Imports crypto-related APIs Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match - AES encryption Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - RC4 Encryption Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Uses Windows cryptography API for obfuscation2c:T491,file/memory contains long string with (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "unins000.dat") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00003816.00000000.152180.026C0000.00000004.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp")2d:T6bd,file/memory contains long string with (Indicator: "sendmessage"; File: "is-FERRI.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-LCD4T.tmp") file/memory contains long string with (Indicator: "sendmessage"; File: "is-E84U0.tmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00005840-00000C2B-1431647597") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005840-00000C2B-1431647676") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "Setup.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "Setup.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "Setup.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "Setup.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "Setup.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "Setup.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "Setup.exe") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "Setup.exe")2e:T407,"Setup.tmp" called "EnumWindows" with parameter "1702524" - (UID: 00000000-00007116) "Setup.tmp" called "EnumWindows" with parameter "1702012" - (UID: 00000000-00007116) "Setup.tmp" called "EnumWindows" with parameter "1700940" - (UID: 00000000-00007116) "Setup.tmp" called "EnumWindows" with parameter "1703020" - (UID: 00000000-00007116) "Setup.tmp" called "EnumWindows" with parameter "1695620" - (UID: 00000000-00007116) "Setup.tmp" called "EnumWindows" with parameter "1699732" - (UID: 00000000-00007116) "Setup.tmp" called "EnumWindows" with parameter "1699636" - (UID: 00000000-00007116) "Setup.tmp" called "EnumWindows" with parameter "1699628" - (UID: 00000000-00007116) "Setup.tmp" called "EnumWindows" with parameter "1699644" - (UID: 00000000-00007116) "Setup.tmp" called "EnumWindows" with parameter "1115062" - (UID: 00000000-00007116) "Setup.tmp" called "EnumWindows" with parameter "1702988" - (UID: 00000000-00007116) "Start.exe" called "EnumWindows" with parameter "19916948" - (UID: 00000000-00001192)2f:T7f0,"Setup.tmp" called "GetWindowTextW" with parameter "Select the language to use during the installation:" - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "Setup" - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "License Agreement" - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "Please read the following important information before continuing." - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation." - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "I &accept the agreement" - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "I &do not accept the agreement" - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "&Next >" - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "Select Destination Location" - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "Where should PassFab iPhone Unlocker be installed?" - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "B&rowse..." - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "Setup will install PassFab iPhone Unlocker into the following folder." - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "To continue, click Next. If you would like to select a different folder, click Browse." - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "At least 163.9 MB of free disk space is required." - (UID: 00000000-00007116) "Setup.tmp" called "GetWindowTextW" with parameter "< &Back" - (UID: 00000000-00007116)30:T2ead,"Setup.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003816) "Setup.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000001177157b0c7458fe1900ffffffffffffffff220000000000000058fe19000000000000000000000000000000000000000000220000c0000000000100000000000000ffffffffffffffff6c225ef00000ce7630e011775900d9770400000010fe1900220000c088fe1900b0e8da7770225ef0feffffff60fe1900aaf903770500000030e01177f9a81277010000000000000009000000000000007cfe1900e4ebd0760000000074fe19000800000001000000200000005c3a4000a4fe19006b3a40009cfe1900b0f37b023c6b4000016f4000b0f37b02d4fe19000a994000c8fe19000d3a40001f0000007c154100b4aa40000e2e4000216140000e000000 (UID: 00000000-00003816) "Setup.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003816) "Setup.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003816) "Setup.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000c74a0fe1900ffffffffffffffff2200000000000000a0fe19000000000000000000000000000000000000000000220000c0000000000100000000000000ffffffffffffffff1a55faea0000ce7630e011775900d9770400000058fe1900220000c0d4fe1900b0e8da77f655faeafeffffffacfe1900aaf903770500000030e01177f9a812770100000000000000090000000000000000000000c8fe1900e4ebd07600000000c0fe190008000000010000002000000048454000f0fe190057454000e8fe1900b0f39302c4a4400001ac4000b0f3930220ff1900161a410014ff1900f9444000910000007c0550009c34410022304000b98640000d000000 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000cf6d6c0c4c6f63616c650000000000000000000000000000000000000000000000000000010000000000000000010000000300000004000000010000000000000001cf6d6c0c4c435479706500000000000000000000000000000000000000000000000000000000000000000000090400000c000000c58a7e0d0cff190024104100090400000c000000a8fe1900020000002c000000f8fe19003e304000c65240007c055000090400006d324100753241000d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020ff1900e5055000 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000af76b58d7e0d150000000cff190060fe29773e3040009d52400008ff1900829640008a964000840c50000000af760000000044ff1900f43e48000000af76e03f48004f000000 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000500044ff19000c964a000cfe1900140100000a000000000000005d58000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000af76b58d7e0d150000000cff190060fe29773e3040009d52400008ff190082964000 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002c6b4e00758d7e0dc8fe19002074f0753e3040009d524000c4fe1900829640008a96400000ddcf760000ce760000000020ff19003b6a4e000000ed752c6b4e0001000000090000000010000000000100fffffeff0300000002000000d8210000000001000600004f (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000190028da190034da190024da1900000000007b23718f2672faea0000040030df0c89f8d91900b0e8da777686079dfeffffff08da190080715d000000f27630fa4673d447d777c547d7779671faeaa4e01900d4d06200424fbf98fcd9190048dd1900b0ac5b73ffffffff3cda190072fa467348dd19007cce387372fa46730100000000000000020000007cce387368da1900a4e01900d4d0620080fa46730000000070da19007c0b077710aa1377964cbf98 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310019002672faea34d9190094d919005cee19005c000000f6776200f4db1900caffd577f6776200e8d919005c000000d877620098dc1900f2ffd5770000000000000000424fbf98fcd9190048dd1900b0ac5b73ffffffff3cda190072fa467314da19007cce387372fa46730100000000000000020000007cce387368da1900a4e019006412630080fa4673a29404772a000000f8a4610000000000964cbf98 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310019002672faea34d9190094d919005cee19005c000000f6776200f4db1900caffd577f6776200e8d919005c000000d877620098dc1900f2ffd5770000000000000000424fbf98fcd9190048dd1900b0ac5b73ffffffff3cda190072fa467314da19007cce387372fa46730100000000000000020000007cce387368da1900a4e01900441b630080fa4673a294047726000000e0de610000000000964cbf98 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310019002672faea34d9190094d919005cee19005c00000056146300f4db1900caffd57756146300e8d919005c0000003814630098dc1900f2ffd5770000000000000000424fbf98fcd9190048dd1900b0ac5b73ffffffff3cda190072fa467314da19007cce387372fa46730100000000000000020000007cce387368da1900a4e01900441b630080fa4673a294047729000000389e610000000000964cbf98 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310019002672faea34d9190094d919005cee19005c00000056146300f4db1900caffd57756146300e8d91900dfe9d777d670faea000800000808000000005d0000000000424fbf98fcd9190048dd1900b0ac5b73ffffffff3cda190072fa467314da19007cce387372fa46730100000000000000020000007cce387368da1900a4e01900b45a630080fa4673a2940477270000007049630000000000964cbf98 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310019002672faea34d9190094d919005cee19005c00000056146300f4db1900caffd57756146300e8d919005c0000003814630098dc1900f2ffd5770000000000000000424fbf98fcd9190048dd1900b0ac5b73ffffffff3cda190072fa467314da19007cce387372fa46730100000000000000020000007cce387368da1900a4e01900b45a630080fa4673a29404772a000000303b630000000000964cbf98 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d580000020000000000370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600340046004200440030007d000000330038003100320033003900310030003000310019002672faea34d9190094d919005cee19005c000000765b6300f4db1900caffd577765b6300e8d919005c000000585b630098dc1900f2ffd5770000000000000000424fbf98fcd9190048dd1900b0ac5b73ffffffff3cda190072fa467314da19007cce387372fa46730100000000000000020000007cce387368da1900a4e019000c60630080fa4673a294047729000000103a630000000000964cbf98 (UID: 00000000-00007116) "Setup.tmp" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007116)31:T429,Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "Setup.exe") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; File: "Setup.exe") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "Setup.exe") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; File: "Setup.exe") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "Setup.exe") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003816.00000000.152180.00412000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00003816.00000001.154097.00401000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005840.00000000.155743.74179000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp")32:T409,"Setup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Setup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Setup.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Setup.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Start.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Start.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "PassFab iPhone Unlocker.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")33:T5a7,Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "Setup.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "Setup.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Setup.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "Setup.exe") Found reference to API "CFURLResponseGetCreationTime" (Indicator: "GetCreationTime"; File: "Setup.exe") Found reference to API "CFHTTPCookieGetCreationTime" (Indicator: "GetCreationTime"; File: "Setup.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "Setup.exe") Found reference to API "GetLastWriteTimeUtc" (Indicator: "GetLastWriteTime"; Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp") Found reference to API "GetLastWriteTime" (Indicator: "GetLastWriteTime"; Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp, 00000000-00005840.00000000.155743.74179000.00000002.mdmp, 00000000-00005840.00000000.155743.74482000.00000002.mdmp")34:T59d,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "Setup.exe") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; File: "Setup.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "Setup.exe") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003816.00000000.152180.00412000.00000004.mdmp") Found reference to API "GetMonitorInfo" (Indicator: "GetMonitorInfo"; Source: "00000000-00005840.00000000.155743.09EC2000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005840.00000000.155743.74179000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005840.00000000.155743.74179000.00000002.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp")35:T4b9,Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "Setup.exe") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; File: "Setup.exe") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "Setup.exe") file/memory contains long string with (Indicator: "GetUserDefaultUILanguage"; File: "NetFrameCheck.log") Found reference to API "GetTextCharsetInfo" (Indicator: "GetTextCharset"; File: "Setup.exe") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "Setup.exe") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "Setup.exe") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "Setup.exe") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "Setup.exe") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; Source: "00000000-00003816.00000000.152180.00412000.00000004.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00003816.00000000.152180.00412000.00000004.mdmp")36:Tcdd,"Setup.tmp" queries volume information of "C:\share" at 00000000-00007116-00000C17-1389794730 "Setup.tmp" queries volume information of "C:\" at 00000000-00007116-00000C17-1420303034 "Setup.tmp" queries volume information of "C:\" at 00000000-00007116-00000C17-1420355666 "Setup.tmp" queries volume information of "C:\" at 00000000-00007116-00000C17-1420378926 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\log4net.dll" at 00000000-00005840-00000C17-1430327268 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\TS.UI.dll" at 00000000-00005840-00000C17-1432296786 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\AgentSupportCLR.dll" at 00000000-00005840-00000C17-1432885140 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\AgentSupportCLR.dll" at 00000000-00005840-00000C17-1432889476 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\AgentSupportCLR.dll" at 00000000-00005840-00000C17-1432889693 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\SecurityLaunchCLR.dll" at 00000000-00005840-00000C17-1433284365 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\SecurityLaunchCLR.dll" at 00000000-00005840-00000C17-1433288447 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\SecurityLaunchCLR.dll" at 00000000-00005840-00000C17-1433288690 "PassFab iPhone Unlocker.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition\v4.0_4.0.0.0__b77a5c561934e089\System.ComponentModel.Composition.dll" at 00000000-00005840-00000C17-1433364870 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\System.Windows.Interactivity.dll" at 00000000-00005840-00000C17-1433665404 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\IosManager.dll" at 00000000-00005840-00000C17-1434104190 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\IosManager.dll" at 00000000-00005840-00000C17-1434108740 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\IosManager.dll" at 00000000-00005840-00000C17-1434108947 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\Downloader.dll" at 00000000-00005840-00000C17-1434362677 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\BugSplatDotNet.dll" at 00000000-00005840-00000C17-1436057468 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\RegisterAndLog.dll" at 00000000-00005840-00000C17-1436072624 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\RegisterAndLog.dll" at 00000000-00005840-00000C17-1436076537 "PassFab iPhone Unlocker.exe" queries volume information of "C:\inetpub\PassFab iPhone Unlocker\RegisterAndLog.dll" at 00000000-00005840-00000C17-143607674937:Td6c,"Setup.exe" called "CreateDirectoryW" with parameter %TEMP%\is-NI9S7.tmp (UID: 00000000-00003816) "Setup.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-GO4C5.tmp (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-GO4C5.tmp\_isetup (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\config (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\7z (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\Monitor (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ar.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ca.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\cs.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\da.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\de.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\el.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\en.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\es.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\es_419.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\fi.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\fr.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\he.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\hr.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\hu.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\id.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\it.lproj (UID: 00000000-00007116) "Setup.tmp" called "CreateDirectoryW" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ja.lproj (UID: 00000000-00007116)38:T3456,"Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003816) "Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003816) "Setup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003816) "Setup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003816) "Setup.exe" called "LoadLibrary" with a parameter C:\Setup.ENU (UID: 00000000-00003816) "Setup.exe" called "LoadLibrary" with a parameter C:\Setup.EN (UID: 00000000-00003816) "Setup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003816) "Setup.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-NI9S7.tmp\Setup.ENU (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter %TEMP%\is-NI9S7.tmp\Setup.EN (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\MSFTEDIT.DLL (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00007116) "Setup.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007116) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007924) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007924) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007924) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007924) "Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001192) "Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001192) "Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001192) "Start.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001192) "Start.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001192) "Start.exe" called "LoadLibrary" with a parameter C:\inetpub\PassFab iPhone Unlocker\StartENU.dll (UID: 00000000-00001192) "Start.exe" called "LoadLibrary" with a parameter C:\inetpub\PassFab iPhone Unlocker\StartLOC.dll (UID: 00000000-00001192) "Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00001192) "Start.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00001192) "Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001704) "Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001704) "Start.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001704) "Start.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001704) "Start.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00001704) "Start.exe" called "LoadLibrary" with a parameter C:\inetpub\PassFab iPhone Unlocker\StartENU.dll (UID: 00000000-00001704) "Start.exe" called "LoadLibrary" with a parameter C:\inetpub\PassFab iPhone Unlocker\StartLOC.dll (UID: 00000000-00001704) "Start.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00001704) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\caea3281a7d99342eef4090a95f26f0d\WindowsBase.ni.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\e14398ba2e1558a1b8b96dc1c3881800\PresentationCore.ni.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\0dd57417853faab6451a8108d8c82093\PresentationFramework.ni.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xaml\4c2cff4c675734a6a5d9a32bcb3c1dd5\System.Xaml.ni.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\PresentationNative_v0400.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter PresentationNative_v0400.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter Advapi32.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\shcore.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter shcore.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter C:\inetpub\PassFab iPhone Unlocker\AgentSupportCLR.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter C:\inetpub\PassFab iPhone Unlocker\SecurityLaunchCLR.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter C:\inetpub\PassFab iPhone Unlocker\IosManager.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter C:\inetpub\PassFab iPhone Unlocker\RegisterAndLog.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter C:\inetpub\PassFab iPhone Unlocker\msvcrt.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "LoadLibrary" with a parameter VCRUNTIME140_CLR0400.dll (UID: 00000000-00005840)39:Tfc0b,"Setup.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003816) "Setup.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003816) "Setup.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter WINNLSEnableIME (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00007116) "Setup.tmp" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00007116) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007924) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007924) "Start.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001192) "Start.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00001704) "Start.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00001704) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetEnvironmentStrings (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FreeEnvironmentStrings (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateMutex (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter EnumerateTraceGuidsEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetStockObjectW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter RegisterClassEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter RegisterClassExW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetWindowLongWrapper (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetWindowLongWrapperW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetProcessDpiAwareness (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetThreadDpiAwarenessContext (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetDpiForSystem (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter DispatchMessage (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry_RetAddr (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetCurrentDirectory (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetStdHandleW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetConsoleTextAttribute (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter SetConsoleTextAttributeW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter _exit (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter __std_type_info_destroy_list (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetWindowLongWrapper (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetWindowLongWrapperW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005840) "PassFab iPhone Unlocker.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005840)3a:T540,file/memory contains long string with (Indicator: "ShellExecute"; File: "NetFrameCheck.log") Found reference to API "ShellExecuteEx failed (%d)." (Indicator: "ShellExecute"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx" (Indicator: "ShellExecute"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx returned hProcess=0" (Indicator: "ShellExecute"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "Setup.exe") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "Setup.exe") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp") Found reference to API "ShellExecuteEx failed (%d)." (Indicator: "ShellExecute"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx returned hProcess=0" (Indicator: "ShellExecute"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp")3b:T430,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "Setup.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "Setup.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "Setup.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "Setup.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005840.00000000.155743.74111000.00000020.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005840.00000000.155743.74111000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005840.00000000.155743.74111000.00000020.mdmp") Found reference to API "__crtCreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005840.00000000.155743.74111000.00000020.mdmp") Found reference to API "__crtCreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005840.00000000.155743.74111000.00000020.mdmp")3c:T865,"is-4JQOQ.tmp" contains export function called "NSAMPMDesignation" at ordinal 1 "is-4JQOQ.tmp" contains export function called "NSAllHashTableObjects" at ordinal 2 "is-4JQOQ.tmp" contains export function called "NSAllMapTableKeys" at ordinal 3 "is-4JQOQ.tmp" contains export function called "NSAllMapTableValues" at ordinal 4 "is-4JQOQ.tmp" contains export function called "NSAllocateCollectable" at ordinal 5 "is-4JQOQ.tmp" contains export function called "NSAllocateMemoryPages" at ordinal 6 "is-4JQOQ.tmp" contains export function called "NSAllocateObject" at ordinal 7 "is-4JQOQ.tmp" contains export function called "NSAllocateObjectArray" at ordinal 8 "is-4JQOQ.tmp" contains export function called "NSAllocateScannedUncollectable" at ordinal 9 "is-4JQOQ.tmp" contains export function called "NSArgumentDomain" at ordinal 10 "is-4JQOQ.tmp" contains export function called "NSAssertionHandlerKey" at ordinal 11 "is-4JQOQ.tmp" contains export function called "NSAutoreleaseObject" at ordinal 12 "is-4JQOQ.tmp" contains export function called "NSAverageKeyValueOperator" at ordinal 13 "is-4JQOQ.tmp" contains export function called "NSBOOLFromString" at ordinal 14 "is-4JQOQ.tmp" contains export function called "NSBundleDidLoadNotification" at ordinal 15 "is-4JQOQ.tmp" contains export function called "NSCharacterConversionException" at ordinal 16 "is-4JQOQ.tmp" contains export function called "NSClassDescriptionNeededForClassNotification" at ordinal 17 "is-4JQOQ.tmp" contains export function called "NSClassFromObject" at ordinal 18 "is-4JQOQ.tmp" contains export function called "NSClassFromString" at ordinal 19 "is-4JQOQ.tmp" contains export function called "NSCocoaErrorDomain" at ordinal 20 "is-4JQOQ.tmp" contains export function called "NSCompareCString" at ordinal 21 "is-4JQOQ.tmp" contains export function called "NSCompareCharacters" at ordinal 22 "is-4JQOQ.tmp" contains export function called "NSCompareHashTables" at ordinal 23 "is-4JQOQ.tmp" contains export function called "NSCompareMapTables" at ordinal 24 "is-4JQOQ.tmp" contains export function called "NSConnectionDidDieNotification" at ordinal 253d:Tae2,"Setup.exe" with parameter %TEMP%\is-NI9S7.tmp (UID: 00000000-00003816) "Setup.tmp" with parameter %TEMP%\is-GO4C5.tmp (UID: 00000000-00007116) "Setup.tmp" with parameter %TEMP%\is-GO4C5.tmp\_isetup (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\config (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\7z (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\Monitor (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ar.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ca.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\cs.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\da.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\de.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\el.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\en.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\es.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\es_419.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\fi.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\fr.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\he.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\hr.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\hu.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\id.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\it.lproj (UID: 00000000-00007116) "Setup.tmp" with parameter C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ja.lproj (UID: 00000000-00007116)3e:T9a8,"\Sessions\1\BaseNamedObjects\Local\SM0:7116:168:WilStaging_02" "\Sessions\1\BaseNamedObjects\SM0:7116:64:WilError_03" "\Sessions\1\BaseNamedObjects\Local\SM0:7116:64:WilError_03" "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit" "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" "\Sessions\1\BaseNamedObjects\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults"3f:T96d,"PassFab iPhone Unlocker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:ffffffffc0000135] "PassFab iPhone Unlocker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:ffffffffc0000135] "PassFab iPhone Unlocker.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "PassFab iPhone Unlocker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "PassFab iPhone Unlocker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "PassFab iPhone Unlocker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\PresentationNative_v0400.dll" - [base:0; Status:ffffffffc0000135] "PassFab iPhone Unlocker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\shcore.dll" - [base:0; Status:ffffffffc0000135] "PassFab iPhone Unlocker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "PassFab iPhone Unlocker.exe" failed to load missing module "C:\inetpub\PassFab iPhone Unlocker\RegisterAndLog.dll" - [base:0; Status:ffffffffc0000142] "PassFab iPhone Unlocker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "PassFab iPhone Unlocker.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "PassFab iPhone Unlocker.exe" failed to load missing module "C:\inetpub\PassFab iPhone Unlocker\msvcrt.dll" - [base:0; Status:ffffffffc0000135] "PassFab iPhone Unlocker.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\VCRUNTIME140_CLR0400.dll" - [base:0; Status:ffffffffc0000135]40:T81f,"Setup.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-A1MCP.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-4JQOQ.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-BIV86.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-V7L16.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-M4VTM.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-LCR95.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-KD5P6.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-1KKJQ.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-9BSBF.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-46K6A.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Setup.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-23FR4.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-7M434.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-GUR4M.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-3JSDU.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "is-CQCML.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-R3LHR.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT41:T368a,"Setup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76f20000 "Setup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76f20000 "Setup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76f20000 "Setup.exe" loaded module "KERNEL32" at base 76ce0000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 77680000 "Setup.exe" loaded module "COMCTL32.DLL" at base 757b0000 "Setup.exe" loaded module "KERNEL32.DLL" at base 76ce0000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 75250000 "Setup.exe" loaded module "NTDLL.DLL" at base 77d30000 "Setup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75160000 "Setup.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76f20000 "Setup.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76f20000 "Setup.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76f20000 "Setup.tmp" loaded module "KERNEL32" at base 76ce0000 "Setup.tmp" loaded module "IMM32.DLL" at base 75a40000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 75250000 "Setup.tmp" loaded module "KERNEL32.DLL" at base 76ce0000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 77680000 "Setup.tmp" loaded module "RPCRT4.DLL" at base 775a0000 "Setup.tmp" loaded module "COMCTL32" at base 757b0000 "Setup.tmp" loaded module "COMCTL32.DLL" at base 757b0000 "Setup.tmp" loaded module "UXTHEME.DLL" at base 75250000 "Setup.tmp" loaded module "DWMAPI.DLL" at base 74190000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76e40000 "Setup.tmp" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75dc0000 "Setup.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76940000 "Setup.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76940000 "Setup.tmp" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 75ed0000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76af0000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 74190000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73300000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 732c0000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76dd0000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 747e0000 "Setup.tmp" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 731c0000 "Setup.tmp" loaded module "USER32.DLL" at base 76940000 "Setup.tmp" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 74b10000 "Setup.tmp" loaded module "SSPICLI.DLL" at base 74720000 "Setup.tmp" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76f20000 "Setup.tmp" loaded module "VIRTDISK.DLL" at base 74e80000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73330000 "Setup.tmp" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 73a10000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 73a10000 "Setup.tmp" loaded module "SHELL32.DLL" at base 77680000 "Setup.tmp" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 730f0000 "Setup.tmp" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 72e20000 "Setup.tmp" loaded module "NTDLL.DLL" at base 77d30000 "Setup.tmp" loaded module "KERNELBASE" at base 76f20000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 76730000 "Setup.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 72da0000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\MSFTEDIT.DLL" at base 72ae0000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 72990000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 72850000 "Setup.tmp" loaded module "%WINDIR%\SYSWOW64\THUMBCACHE.DLL" at base 727f0000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 74200000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 72510000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 66680000 "Setup.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 76f20000 "Setup.tmp" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 76f20000 "Setup.tmp" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 73330000 "Setup.tmp" loaded module "CSCAPI.DLL" at base 74670000 "Setup.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75160000 "cmd.exe" loaded module "KERNEL32" at base 76ce0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76f20000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76f20000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76f20000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75a40000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76f20000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76f20000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76f20000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76ce0000 "cmd.exe" loaded module "NTDLL.DLL" at base 77d30000 "cmd.exe" loaded module "KERNELBASE" at base 76f20000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 75210000 "Start.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76f20000 "Start.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76f20000 "Start.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76f20000 "Start.exe" loaded module "KERNEL32" at base 76ce0000 "Start.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 75250000 "Start.exe" loaded module "COMCTL32.DLL" at base 757b0000 "Start.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 76f20000 "Start.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_9FA79A41E294B962\GDIPLUS.DLL" at base 74f60000 "Start.exe" loaded module "KERNEL32.DLL" at base 76ce0000 "Start.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 747e0000 "Start.exe" loaded module "RPCRT4.DLL" at base 775a0000 "Start.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 74560000 "Start.exe" loaded module "USER32.DLL" at base 76940000 "Start.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 74b10000 "Start.exe" loaded module "SSPICLI.DLL" at base 74720000 "Start.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 76f20000 "Start.exe" loaded module "VIRTDISK.DLL" at base 74e80000 "Start.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 73330000 "Start.exe" loaded module "%WINDIR%\SYSWOW64\WINTYPES.DLL" at base 73a10000 "Start.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 73a10000 "Start.exe" loaded module "SHELL32.DLL" at base 77680000 "Start.exe" loaded module "%WINDIR%\SYSWOW64\APPRESOLVER.DLL" at base 74490000 "Start.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73d50000 "Start.exe" loaded module "NTDLL.DLL" at base 77d30000 "Start.exe" loaded module "KERNELBASE" at base 76f20000 "Start.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75160000 "Start.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 75210000 "PassFab iPhone Unlocker.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76f20000 "PassFab iPhone Unlocker.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76f20000 "PassFab iPhone Unlocker.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76f20000 "PassFab iPhone Unlocker.exe" loaded module "KERNEL32" at base 76ce0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\10E5A0803D11B8B826DBEB56A1F98239\SYSTEM.NI.DLL" at base 704e0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\53FCC36B6B7C9CC86E5D7484C1F93BD8\SYSTEM.CORE.NI.DLL" at base 6fcc0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\CAEA3281A7D99342EEF4090A95F26F0D\WINDOWSBASE.NI.DLL" at base 72640000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74390000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76dd0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\E14398BA2E1558A1B8B96DC1C3881800\PRESENTATIONCORE.NI.DLL" at base 6f060000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\0DD57417853FAAB6451A8108D8C82093\PRESENTATIONFRAMEWORK.NI.DLL" at base 6dc30000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XAML\4C2CFF4C675734A6A5D9A32BCB3C1DD5\SYSTEM.XAML.NI.DLL" at base 72430000 "PassFab iPhone Unlocker.exe" loaded module "KERNEL32.DLL" at base 76ce0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 73c00000 "PassFab iPhone Unlocker.exe" loaded module "USER32.DLL" at base 76940000 "PassFab iPhone Unlocker.exe" loaded module "ADVAPI32.DLL" at base 75ed0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "SHLWAPI.DLL" at base 76730000 "PassFab iPhone Unlocker.exe" loaded module "DWRITE.DLL" at base 6da10000 "PassFab iPhone Unlocker.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76f20000 "PassFab iPhone Unlocker.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76f20000 "PassFab iPhone Unlocker.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76f20000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 6d8a0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 6d7c0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "VERSION.DLL" at base 75a20000 "PassFab iPhone Unlocker.exe" loaded module "NTDLL.DLL" at base 77d30000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\E4E680611F69D26D704E61DD8BFA4ECE\SYSTEM.CONFIGURATION.NI.DLL" at base 744b0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\638BA173C955AB83F37EDBAB9B896F44\SYSTEM.XML.NI.DLL" at base 73410000 "PassFab iPhone Unlocker.exe" loaded module "SHELL32.DLL" at base 77680000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "BCRYPT.DLL" at base 74360000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "OLE32.DLL" at base 76af0000 "PassFab iPhone Unlocker.exe" loaded module "GDI32.DLL" at base 77cf0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\WINDOWSBASE\V4.0_4.0.0.0__31BF3856AD364E35\PRESENTATIONNATIVE_V0400.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "PRESENTATIONNATIVE_V0400.DLL" at base 6d7c0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\WINDOWSBASE\V4.0_4.0.0.0__31BF3856AD364E35\SHCORE.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "SHCORE.DLL" at base 76670000 "PassFab iPhone Unlocker.exe" loaded module "C:\INETPUB\PASSFAB IPHONE UNLOCKER\AGENTSUPPORTCLR.DLL" at base 73e70000 "PassFab iPhone Unlocker.exe" loaded module "MSCOREE.DLL" at base 743e0000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "PSAPI.DLL" at base 76930000 "PassFab iPhone Unlocker.exe" loaded module "C:\INETPUB\PASSFAB IPHONE UNLOCKER\SECURITYLAUNCHCLR.DLL" at base 73e10000 "PassFab iPhone Unlocker.exe" loaded module "C:\INETPUB\PASSFAB IPHONE UNLOCKER\IOSMANAGER.DLL" at base 73dd0000 "PassFab iPhone Unlocker.exe" loaded module "C:\INETPUB\PASSFAB IPHONE UNLOCKER\REGISTERANDLOG.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 6ca90000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "COMBASE.DLL" at base 77230000 "PassFab iPhone Unlocker.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 77230000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 77230000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "C:\INETPUB\PASSFAB IPHONE UNLOCKER\MSVCRT.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "MSVCRT.DLL" at base 76500000 "PassFab iPhone Unlocker.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\VCRUNTIME140_CLR0400.DLL" at base 0 "PassFab iPhone Unlocker.exe" loaded module "VCRUNTIME140_CLR0400.DLL" at base 743c000042:T10e0,"Setup.exe" was detected as "Inno Setup Module" and name: "Installer" "Setup.exe" was detected as "Embarcadero Delphi" and name: "Compiler" "Setup.exe" was detected as "Turbo Linker" and name: "Linker" "is-A1MCP.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-A1MCP.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-A1MCP.tmp" was detected as "Turbo Linker" and name: "Linker" "is-4JQOQ.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-4JQOQ.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-4JQOQ.tmp" was detected as "Turbo Linker" and name: "Linker" "is-BIV86.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-BIV86.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-BIV86.tmp" was detected as "Turbo Linker" and name: "Linker" "is-V7L16.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-V7L16.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-V7L16.tmp" was detected as "Turbo Linker" and name: "Linker" "is-M4VTM.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-M4VTM.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-M4VTM.tmp" was detected as "Turbo Linker" and name: "Linker" "is-LCR95.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-LCR95.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-LCR95.tmp" was detected as "Turbo Linker" and name: "Linker" "is-KD5P6.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-KD5P6.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-KD5P6.tmp" was detected as "Turbo Linker" and name: "Linker" "is-1KKJQ.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-1KKJQ.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-1KKJQ.tmp" was detected as "Turbo Linker" and name: "Linker" "is-9BSBF.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-9BSBF.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-9BSBF.tmp" was detected as "Turbo Linker" and name: "Linker" "is-46K6A.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-46K6A.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-46K6A.tmp" was detected as "Turbo Linker" and name: "Linker" "is-M495I.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-M495I.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-M495I.tmp" was detected as "Turbo Linker" and name: "Linker" "is-0493E.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-0493E.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-0493E.tmp" was detected as "Turbo Linker" and name: "Linker" "Setup.tmp" was detected as "Inno Setup Module" and name: "Installer" "Setup.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "Setup.tmp" was detected as "Turbo Linker" and name: "Linker" "is-23FR4.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-23FR4.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-23FR4.tmp" was detected as "Turbo Linker" and name: "Linker" "is-7M434.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-7M434.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-7M434.tmp" was detected as "Turbo Linker" and name: "Linker" "is-GUR4M.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-GUR4M.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-GUR4M.tmp" was detected as "Turbo Linker" and name: "Linker" "is-3JSDU.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-3JSDU.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-3JSDU.tmp" was detected as "Turbo Linker" and name: "Linker" "is-CQCML.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-CQCML.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-CQCML.tmp" was detected as "Turbo Linker" and name: "Linker" "is-R3LHR.tmp" was detected as "Inno Setup Module" and name: "Installer" "is-R3LHR.tmp" was detected as "Embarcadero Delphi" and name: "Compiler" "is-R3LHR.tmp" was detected as "Turbo Linker" and name: "Linker"43:T954,"Setup.tmp" touched "Activation Layout Preferences" (Path: "HKCU\WOW6432NODE\CLSID\{0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}\TREATAS") "Setup.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Setup.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "Setup.tmp" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Setup.tmp" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "Setup.tmp" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "Setup.tmp" touched "Start Menu Cache" (Path: "HKCU\WOW6432NODE\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "Setup.tmp" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "Setup.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "Setup.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "Setup.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "Setup.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "Setup.tmp" touched "Local Icon Cache" (Path: "HKCU\WOW6432NODE\CLSID\{2155FEE3-2419-4373-B102-6843707EB41F}\TREATAS") "Setup.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "Setup.tmp" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "Start.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "Start.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "PassFab iPhone Unlocker.exe" touched "NDP SymBinder" (Path: "HKCU\WOW6432NODE\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32")44:T53a,"Setup.exe" has an executable section named ".text" "Setup.exe" has an executable section named ".itext" "is-A1MCP.tmp" has an executable section named ".text" "is-4JQOQ.tmp" has an executable section named ".text" "is-BIV86.tmp" has an executable section named ".text" "is-V7L16.tmp" has an executable section named ".text" "is-M4VTM.tmp" has an executable section named ".text" "is-LCR95.tmp" has an executable section named ".text" "is-LCR95.tmp" has an executable section named ".text.un" "is-KD5P6.tmp" has an executable section named ".text" "is-1KKJQ.tmp" has an executable section named ".text" "is-9BSBF.tmp" has an executable section named ".text" "is-46K6A.tmp" has an executable section named ".text" "is-M495I.tmp" has an executable section named ".text" "is-0493E.tmp" has an executable section named ".text" "Setup.tmp" has an executable section named ".text" "Setup.tmp" has an executable section named ".itext" "is-23FR4.tmp" has an executable section named ".text" "is-7M434.tmp" has an executable section named ".textbss" "is-7M434.tmp" has an executable section named ".text" "is-GUR4M.tmp" has an executable section named ".text" "is-3JSDU.tmp" has an executable section named ".text" "is-CQCML.tmp" has an executable section named ".text" "is-R3LHR.tmp" has an executable section named ".text"45:T53a,"Setup.exe" has an writable section named ".data" "Setup.exe" has an writable section named ".bss" "Setup.exe" has an writable section named ".idata" "Setup.exe" has an writable section named ".tls" "is-A1MCP.tmp" has an writable section named ".data" "is-4JQOQ.tmp" has an writable section named ".data" "is-4JQOQ.tmp" has an writable section named ".objc_im" "is-BIV86.tmp" has an writable section named ".data" "is-V7L16.tmp" has an writable section named ".data" "is-M4VTM.tmp" has an writable section named ".data" "is-M4VTM.tmp" has an writable section named ".tls" "is-LCR95.tmp" has an writable section named ".data" "is-KD5P6.tmp" has an writable section named ".data" "is-KD5P6.tmp" has an writable section named ".bss" "is-KD5P6.tmp" has an writable section named ".idata" "is-KD5P6.tmp" has an writable section named ".CRT" "is-KD5P6.tmp" has an writable section named ".tls" "is-1KKJQ.tmp" has an writable section named ".data" "is-1KKJQ.tmp" has an writable section named ".objc_im" "is-9BSBF.tmp" has an writable section named ".data" "is-46K6A.tmp" has an writable section named ".data" "is-M495I.tmp" has an writable section named ".data" "is-0493E.tmp" has an writable section named ".data" "is-0493E.tmp" has an writable section named ".bss" "is-0493E.tmp" has an writable section named ".idata"46:T2ff1,"Setup.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x5c,push ebx,push esi,push edi,xor eax, eax,mov dword ptr [ebp - 0x3c], eax,mov dword ptr [ebp - 0x40], eax,mov dword ptr [ebp - 0x5c], eax,mov dword ptr [ebp - 0x30], eax,mov dword ptr [ebp - 0x38], eax,mov dword ptr [ebp - 0x34], eax,mov dword ptr [ebp - 0x2c], eax,mov dword ptr [ebp - 0x28], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x410144,call 0x4065d4,xor eax, eax,push ebp,push 0x411ebe,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor edx, edx,push ebp,push 0x411e7a,push dword ptr fs:[edx],mov dword ptr fs:[edx], esp,mov eax, dword ptr [0x415b48],call 0x40ed40,call 0x40e894,cmp byte ptr [0x412adc], 0,je 0x41184c," "is-A1MCP.tmp" file has an entrypoint instructions - "call 0x5541e1,jmp 0x55335b,cmp ecx, dword ptr [0x5dafd4],bnd jne 0x5534ec,bnd ret ,bnd jmp 0x553a79,push ebp,mov ebp, esp,test byte ptr [ebp + 8], 1,push esi,mov esi, ecx,mov dword ptr [esi], 0x5b32f4,je 0x55350e,push 0xc,push esi,call 0x553515,pop ecx,pop ecx,mov eax, esi,pop esi,pop ebp,ret 4,push ebp,mov ebp, esp,push dword ptr [ebp + 8],call 0x410990,pop ecx,pop ebp,ret ,push ebp,mov ebp, esp,mov eax, dword ptr [0x5dafd4],and eax, 0x1f,push 0x20,pop ecx,sub ecx, eax,mov eax, dword ptr [ebp + 8],ror eax, cl," "is-4JQOQ.tmp" file has an entrypoint instructions - "jmp 0x10198262,jmp 0x100ca63a,jmp 0x100f84dc,jmp 0x1008cd85,jmp 0x101640dd,jmp 0x100dd9a3,jmp 0x100230cc,jmp 0x1005471b,jmp 0x10199f8e,jmp 0x100c35d8,jmp 0x1014c802,jmp 0x101995a9,jmp 0x1019979e,jmp 0x100e6a20,jmp 0x10197530,jmp 0x100e64cb,jmp 0x100f71b2,jmp 0x101999ee,jmp 0x1018554c,jmp 0x100f7fb0," "is-BIV86.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x101c8fcb,call 0x101ca182,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x101c8e83,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,mov eax, dword ptr [0x10292760],mov ecx, eax,xor eax, dword ptr [ebp + 8],and ecx, 0x1f,ror eax, cl,pop ebp,ret ,push ebp,mov ebp, esp,mov eax, dword ptr [0x10292760],and eax, 0x1f,push 0x20,pop ecx,sub ecx, eax,mov eax, dword ptr [ebp + 8],ror eax, cl,xor eax, dword ptr [0x10292760],pop ebp,ret ,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0xc],ror eax, cl,pop ebp,ret ," "is-V7L16.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1002abd5,call 0x1002b09b,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1002aa96,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x1002ac50,mov dword ptr [esi], 0x10199c84,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x10199c8c,mov dword ptr [ecx], 0x10199c84,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x1002ac50," "is-M4VTM.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10132555,call 0x10132951,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10132421,add esp, 0xc,pop ebp,ret 0xc,jmp dword ptr [0x10145c90],push 0x101325cb,push dword ptr fs:[0],mov eax, dword ptr [esp + 0x10],mov dword ptr [esp + 0x10], ebp,lea ebp, [esp + 0x10],sub esp, eax,push ebx,push esi,push edi,mov eax, dword ptr [0x101ea23c],xor dword ptr [ebp - 4], eax,xor eax, ebp,push eax,mov dword ptr [ebp - 0x18], esp,push dword ptr [ebp - 8],mov eax, dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xfffffffe,mov dword ptr [ebp - 8], eax," "is-LCR95.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1006be6d,call 0x10076df4,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1006bd67,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,push ecx,and dword ptr [ebp - 4], 0,push esi,lea eax, [ebp - 4],push eax,push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10076e8a,mov esi, eax,add esp, 0xc,test esi, esi,jne 0x1006bebb,cmp dword ptr [ebp - 4], eax,je 0x1006bebb,call 0x1006de24,test eax, eax,je 0x1006bebb,call 0x1006de24,mov ecx, dword ptr [ebp - 4],mov dword ptr [eax], ecx,mov eax, esi,pop esi,leave ,ret ," "is-KD5P6.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,push edi,push esi,push ebx,sub esp, 0x1c,mov ebx, dword ptr [ebp + 0xc],mov esi, dword ptr [ebp + 8],mov edi, dword ptr [ebp + 0x10],cmp ebx, 1,je 0x616410b0,mov dword ptr [esp], esi,mov dword ptr [esp + 8], edi,mov dword ptr [esp + 4], ebx,call 0x61771820,sub esp, 0xc,test ebx, ebx,mov esi, eax,jne 0x616410a3,mov edx, dword ptr [0x617e0004],xor eax, eax,test edx, edx,je 0x616410a3,call 0x61641000,mov eax, esi,lea esp, [ebp - 0xc],pop ebx,pop esi,pop edi,pop ebp,ret 0xc,lea esi, [esi],mov dword ptr [esp], 0x80,call 0x617783e0,test eax, eax,mov dword ptr [0x617e0004], eax," "is-1KKJQ.tmp" file has an entrypoint instructions - "jmp 0x10132373,jmp 0x1009d4ee,jmp 0x1001079d,jmp 0x1005a20c,jmp 0x1000ad5c,jmp 0x100097e4,jmp 0x1003207b,jmp 0x10009867,jmp 0x1002b793,jmp 0x100bf4c6,jmp 0x100795eb,jmp 0x10069556,jmp 0x1009d9e6,jmp 0x10011c3f,jmp 0x1007caf8,jmp 0x100c1060,jmp 0x1001b8dd,jmp 0x10088c84,jmp 0x1005bc1e,jmp 0x1003bf96," "is-9BSBF.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100fa619,call 0x101045a9,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100fa62e,add esp, 0xc,pop ebp,ret 0xc,push 0xc,push 0x10136ea8,call 0x100fcf10,xor eax, eax,inc eax,mov esi, dword ptr [ebp + 0xc],test esi, esi,jne 0x100fa650,cmp dword ptr [0x10190cf4], esi,je 0x100fa734,and dword ptr [ebp - 4], 0,cmp esi, 1,je 0x100fa65e,cmp esi, 2,jne 0x100fa693,mov ecx, dword ptr [0x1010e780],test ecx, ecx,je 0x100fa674,push dword ptr [ebp + 0x10],push esi,push dword ptr [ebp + 8]," "is-46K6A.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100c3626,call 0x100c3b22,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100c34e7,add esp, 0xc,pop ebp,ret 0xc,push 0x10,push 0x1014e6c8,call 0x100c36b0,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,mov byte ptr [ebp - 0x19], bl,mov dword ptr [ebp - 4], ebx,cmp ebx, dword ptr [ebp + 0x10],je 0x100c3672,mov ecx, dword ptr [ebp + 0x14],call dword ptr [0x100ce70c],mov ecx, dword ptr [ebp + 8],call dword ptr [ebp + 0x14],mov eax, dword ptr [ebp + 0xc],add dword ptr [ebp + 8], eax,inc ebx,mov dword ptr [ebp - 0x20], ebx,jmp 0x100c3652,mov al, 1,mov byte ptr [ebp - 0x19], al," "is-M495I.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100f73d6,call 0x1010222a,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100f72d0,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,movzx eax, byte ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],cmp byte ptr [esi + 1], 0x3a,push edi,mov ecx, esi,jne 0x100f7402,lea ecx, [esi + 2],mov dl, byte ptr [ecx],cmp dl, 0x5c,je 0x100f740e,cmp dl, 0x2f,jne 0x100f7414,cmp byte ptr [ecx + 1], 0,je 0x100f7421,test al, 0x10,jne 0x100f7421,mov edi, 0x8000,test dl, dl,jne 0x100f7426,mov edi, 0x4040,shl eax, 7," "is-0493E.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,push edi,push esi,push ebx,sub esp, 0x1c,mov ebx, dword ptr [ebp + 0xc],mov esi, dword ptr [ebp + 8],mov edi, dword ptr [ebp + 0x10],cmp ebx, 1,je 0x660010b0,mov dword ptr [esp], esi,mov dword ptr [esp + 8], edi,mov dword ptr [esp + 4], ebx,call 0x660162c0,sub esp, 0xc,test ebx, ebx,mov esi, eax,jne 0x660010a3,mov edx, dword ptr [0x660fa004],xor eax, eax,test edx, edx,je 0x660010a3,call 0x66001000,mov eax, esi,lea esp, [ebp - 0xc],pop ebx,pop esi,pop edi,pop ebp,ret 0xc,lea esi, [esi],mov dword ptr [esp], 0x80,call 0x66016bb4,test eax, eax,mov dword ptr [0x660fa004], eax," "Setup.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,push esi,push edi,mov eax, 0x4febf4,call 0x408f4c,push -0x14,mov eax, dword ptr [0x504e38],mov eax, dword ptr [eax],mov ebx, dword ptr [eax + 0x170],push ebx,call 0x409e0c,and eax, 0xffffff7f,push eax,push -0x14,mov eax, dword ptr [0x504e38],push ebx,call 0x40a074,xor eax, eax,push ebp,push 0x5015e7,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,push 1,call 0x4097d4,call 0x4fe938,mov eax, dword ptr [0x4fe82c],push eax,push 0x4fe890," "is-23FR4.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100b5807,call 0x100b5c11,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100b56d3,add esp, 0xc,pop ebp,ret 0xc,jmp dword ptr [0x100ba1c8],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x100b588b,push dword ptr fs:[0],mov eax, dword ptr [esp + 0x10],mov dword ptr [esp + 0x10], ebp,lea ebp, [esp + 0x10],sub esp, eax,push ebx,push esi,push edi,mov eax, dword ptr [0x101352e4],xor dword ptr [ebp - 4], eax,xor eax, ebp,push eax,mov dword ptr [ebp - 0x18], esp," "is-7M434.tmp" file has an entrypoint instructions - "jmp 0x100826d0,jmp 0x100d432a,jmp 0x100829c0,jmp 0x100940e0,jmp 0x100d42f4,jmp 0x100d3490,jmp 0x100af950,jmp 0x100d07a0,jmp 0x100859c0,jmp 0x100948d0,jmp 0x100aaf50,jmp 0x100c2b20,jmp 0x10097096,jmp 0x100aa9a0,jmp 0x10095240,jmp 0x10086f70,jmp 0x100d3e20,jmp 0x100d07d0,jmp 0x100c3770,jmp 0x100a21a0," "is-GUR4M.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x100cf3af,cmp dword ptr [0x100fb66c], 0,jmp 0x100cf3d5,cmp esi, 1,je 0x100cf3b9,cmp esi, 2,jne 0x100cf3db,mov eax, dword ptr [0x100ff6b4],test eax, eax,je 0x100cf3cb,push edi,push esi,push ebx,call eax,test eax, eax,je 0x100cf3d7,push edi,push esi,push ebx,call 0x100cf2e8,test eax, eax,jne 0x100cf3db,xor eax, eax,jmp 0x100cf429,push edi,push esi,push ebx,call 0x100460a7,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x100cf3f7,test eax, eax,jne 0x100cf426,push edi,push eax,push ebx,call 0x100cf2e8," "is-3JSDU.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,je 0x1002965b,push dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x1002a55a,pop ecx,pop ebp,ret 0xc,call 0x10052b22,jmp 0x1002964b,push 0xc,push 0x100f44a0,call 0x10052ec0,and dword ptr [ebp - 0x1c], 0,call 0x1005322b,mov edi, eax,mov ecx, dword ptr [0x101079c0],test dword ptr [edi + 0x350], ecx,jne 0x100296d5,push 0x10108428,call dword ptr [0x10109248],and dword ptr [ebp - 4], 0,call 0x10030cc0,lea edx, [eax*4 + 0x10108370]," "is-CQCML.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100bd9a7,call 0x100cf1df,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x100bd8a1,pop ecx,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov edx, dword ptr [esp + 0xc],mov ecx, dword ptr [esp + 4],test edx, edx,je 0x100bda35,xor eax, eax,mov al, byte ptr [esp + 8],test al, al,jne 0x100bd9ec,cmp edx, 0x100,jb 0x100bd9ec,cmp dword ptr [0x10103cd0], 0,je 0x100bd9ec,jmp 0x100cf2cc,push edi,mov edi, ecx,cmp edx, 4,jb 0x100bda25,neg ecx,and ecx, 3,je 0x100bda07," "is-R3LHR.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100c0c35,call 0x100c0c97,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100c0af6,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,sub esp, 0x14,and dword ptr [ebp - 0xc], 0,lea eax, [ebp - 0xc],and dword ptr [ebp - 8], 0,push eax,call dword ptr [0x100c2068],mov eax, dword ptr [ebp - 8],xor eax, dword ptr [ebp - 0xc],mov dword ptr [ebp - 4], eax,call dword ptr [0x100c201c],xor dword ptr [ebp - 4], eax,call dword ptr [0x100c206c],xor dword ptr [ebp - 4], eax,lea eax, [ebp - 0x14],push eax,call dword ptr [0x100c2070],mov eax, dword ptr [ebp - 0x10],"47:T60c,"Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Setup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Setup.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Setup.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Setup.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Setup.tmp" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "Setup.tmp" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Start.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "Start.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\USER PROFILE"; Key: "LANGUAGES") "Start.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME")48:Tfdb,Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00003816-00000C2A-1373758187] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00007116-00000C2A-1374477728] Observed system executable string:"%WINDIR%\system32\shfolder.dll" [Source: 00000000-00007116-00000C2A-1381624282] Observed system executable string:"%WINDIR%\system32\Rstrtmgr.dll" [Source: 00000000-00007116-00000C2A-1381666217] Observed system executable string:"%WINDIR%\system32\shlwapi.dll" [Source: 00000000-00007116-00000C2A-1383104709] Observed system executable string:"%WINDIR%\system32\MSFTEDIT.DLL" [Source: 00000000-00007116-00000C2A-1383393324] Observed system executable string:"%WINDIR%\system32\sfc.dll" [Source: 00000000-00007116-00000C2A-1405079103] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\10e5a0803d11b8b826dbeb56a1f98239\System.ni.dll" [Source: 00000000-00005840-00000C2A-1429341299] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\53fcc36b6b7c9cc86e5d7484c1f93bd8\System.Core.ni.dll" [Source: 00000000-00005840-00000C2A-1429376773] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\caea3281a7d99342eef4090a95f26f0d\WindowsBase.ni.dll" [Source: 00000000-00005840-00000C2A-1429410398] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\e14398ba2e1558a1b8b96dc1c3881800\PresentationCore.ni.dll" [Source: 00000000-00005840-00000C2A-1429470162] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\0dd57417853faab6451a8108d8c82093\PresentationFramework.ni.dll" [Source: 00000000-00005840-00000C2A-1429581208] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xaml\4c2cff4c675734a6a5d9a32bcb3c1dd5\System.Xaml.ni.dll" [Source: 00000000-00005840-00000C2A-1429640235] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" [Source: 00000000-00005840-00000C2A-1429725800] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" [Source: 00000000-00005840-00000C2A-1429861940] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll" [Source: 00000000-00005840-00000C2A-1430103484] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll" [Source: 00000000-00005840-00000C2A-1430137105] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00005840-00000C2A-1430331145] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\e4e680611f69d26d704e61dd8bfa4ece\System.Configuration.ni.dll" [Source: 00000000-00005840-00000C2A-1430429643] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\638ba173c955ab83f37edbab9b896f44\System.Xml.ni.dll" [Source: 00000000-00005840-00000C2A-1430470448] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005840-00000C2A-1430662613] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005840-00000C2A-1430912210] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\WindowsBase\v4.0_4.0.0.0__31bf3856ad364e35\PresentationNative_v0400.dll" [Source: 00000000-00005840-00000C2A-1431117888] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00005840-00000C2A-1432158580] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00005840-00000C2A-1432186173]49:T638,"Setup.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-A1MCP.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-4JQOQ.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-BIV86.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-V7L16.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-M4VTM.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-LCR95.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-KD5P6.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-1KKJQ.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-9BSBF.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-46K6A.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-M495I.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-0493E.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Setup.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-23FR4.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-7M434.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-GUR4M.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-3JSDU.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-CQCML.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-R3LHR.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE4a:Taef6,"Uninstall PassFab iPhone Unlocker.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID kqosode4cb3qku1 Archive ctime=Tue Jul 22 19:40:53 2025 atime=Tue Jul 22 19:40:54 2025 mtime=Tue Jul 22 19:40:22 2025 length=1370000 window=normal IDListSize 0x0163 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\inetpub\PassFab iPhone Unlocker\unins000.exe""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PassFab iPhone Unlocker\Uninstall PassFab iPhone Unlocker.lnk]- [targetUID: 00000000-00007116] "PassFab iPhone Unlocker.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID kqosode4cb3qku1 Archive ctime=Tue Jul 22 19:40:59 2025 atime=Tue Jul 22 19:41:00 2025 mtime=Tue Jul 20 17:04:24 2021 length=4231608 window=normal IDListSize 0x0159 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\inetpub\PassFab iPhone Unlocker\Start.exe""- Location: [%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\PassFab iPhone Unlocker.lnk]- [targetUID: 00000000-00007116] "PassFab iPhone Unlocker.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID kqosode4cb3qku1 Archive ctime=Tue Jul 22 19:40:59 2025 atime=Tue Jul 22 19:41:09 2025 mtime=Tue Jul 20 17:04:24 2021 length=4231608 window=normal IDListSize 0x0159 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\inetpub\PassFab iPhone Unlocker\Start.exe""- Location: [%PUBLIC%\Desktop\PassFab iPhone Unlocker.lnk]- [targetUID: 00000000-00007116] "is-BG4H1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 2 sections"- [targetUID: 00000000-00007116] "is-A1SL3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 12 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-A1SL3.tmp]- [targetUID: 00000000-00007116] "is-3G1HJ.tmp" has type "Zip archive data at least v2.0 to extract compression method=store"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-3G1HJ.tmp]- [targetUID: 00000000-00007116] "is-MP6HN.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-MP6HN.tmp]- [targetUID: 00000000-00007116] "is-BDITL.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-BDITL.tmp]- [targetUID: 00000000-00007116] "is-QLVQ0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-QLVQ0.tmp]- [targetUID: 00000000-00007116] "is-A1MCP.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-A1MCP.tmp]- [targetUID: 00000000-00007116] "is-AQ9IB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-AQ9IB.tmp]- [targetUID: 00000000-00007116] "is-4JQOQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 8 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-4JQOQ.tmp]- [targetUID: 00000000-00007116] "is-BIV86.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-BIV86.tmp]- [targetUID: 00000000-00007116] "is-V7L16.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-V7L16.tmp]- [targetUID: 00000000-00007116] "is-M4VTM.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-M4VTM.tmp]- [targetUID: 00000000-00007116] "is-LCR95.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 15 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LCR95.tmp]- [targetUID: 00000000-00007116] "is-KD5P6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-KD5P6.tmp]- [targetUID: 00000000-00007116] "is-1KKJQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 8 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-1KKJQ.tmp]- [targetUID: 00000000-00007116] "is-9BSBF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-9BSBF.tmp]- [targetUID: 00000000-00007116] "is-46K6A.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-46K6A.tmp]- [targetUID: 00000000-00007116] "is-M495I.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-M495I.tmp]- [targetUID: 00000000-00007116] "is-0493E.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 18 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-0493E.tmp]- [targetUID: 00000000-00007116] "Setup.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\is-NI9S7.tmp\Setup.tmp]- [targetUID: 00000000-00003816] "is-23FR4.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-23FR4.tmp]- [targetUID: 00000000-00007116] "is-7M434.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 7 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-7M434.tmp]- [targetUID: 00000000-00007116] "is-GUR4M.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\7z\is-GUR4M.tmp]- [targetUID: 00000000-00007116] "is-3JSDU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-3JSDU.tmp]- [targetUID: 00000000-00007116] "is-CQCML.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-CQCML.tmp]- [targetUID: 00000000-00007116] "is-R3LHR.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-R3LHR.tmp]- [targetUID: 00000000-00007116] "is-LA5M6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 8 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LA5M6.tmp]- [targetUID: 00000000-00007116] "is-NAEV7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-NAEV7.tmp]- [targetUID: 00000000-00007116] "is-CKQ1E.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-CKQ1E.tmp]- [targetUID: 00000000-00007116] "is-E9FQ3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-E9FQ3.tmp]- [targetUID: 00000000-00007116] "is-N777F.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-N777F.tmp]- [targetUID: 00000000-00007116] "is-OGC2S.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-OGC2S.tmp]- [targetUID: 00000000-00007116] "is-6RRP3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-6RRP3.tmp]- [targetUID: 00000000-00007116] "is-5IDBB.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-5IDBB.tmp]- [targetUID: 00000000-00007116] "is-V6MCR.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-V6MCR.tmp]- [targetUID: 00000000-00007116] "is-VT143.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 8 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-VT143.tmp]- [targetUID: 00000000-00007116] "is-90P4E.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-90P4E.tmp]- [targetUID: 00000000-00007116] "is-FJUE1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-FJUE1.tmp]- [targetUID: 00000000-00007116] "is-R26TH.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-R26TH.tmp]- [targetUID: 00000000-00007116] "is-R9L1J.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-R9L1J.tmp]- [targetUID: 00000000-00007116] "is-N72LL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-N72LL.tmp]- [targetUID: 00000000-00007116] "is-33TGT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-33TGT.tmp]- [targetUID: 00000000-00007116] "is-SL0G3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-SL0G3.tmp]- [targetUID: 00000000-00007116] "is-DG55D.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-DG55D.tmp]- [targetUID: 00000000-00007116] "is-53LFN.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-53LFN.tmp]- [targetUID: 00000000-00007116] "is-T8K3O.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-T8K3O.tmp]- [targetUID: 00000000-00007116] "is-JS9KT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-JS9KT.tmp]- [targetUID: 00000000-00007116] "is-CNI1D.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-CNI1D.tmp]- [targetUID: 00000000-00007116] "is-FERRI.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-FERRI.tmp]- [targetUID: 00000000-00007116] "is-5N14N.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-5N14N.tmp]- [targetUID: 00000000-00007116] "is-F98U6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-F98U6.tmp]- [targetUID: 00000000-00007116] "is-V84VB.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\7z\is-V84VB.tmp]- [targetUID: 00000000-00007116] "is-D7A3P.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-D7A3P.tmp]- [targetUID: 00000000-00007116] "is-366N1.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-366N1.tmp]- [targetUID: 00000000-00007116] "is-VLIDN.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-VLIDN.tmp]- [targetUID: 00000000-00007116] "is-TIL0J.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-TIL0J.tmp]- [targetUID: 00000000-00007116] "is-LKQ00.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LKQ00.tmp]- [targetUID: 00000000-00007116] "is-F4SHH.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-F4SHH.tmp]- [targetUID: 00000000-00007116] "is-2KN6R.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-2KN6R.tmp]- [targetUID: 00000000-00007116] "is-TVOK2.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-TVOK2.tmp]- [targetUID: 00000000-00007116] "is-8EQVV.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-8EQVV.tmp]- [targetUID: 00000000-00007116] "is-VEFR4.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-VEFR4.tmp]- [targetUID: 00000000-00007116] "is-6F73G.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-6F73G.tmp]- [targetUID: 00000000-00007116] "is-KVUP8.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-KVUP8.tmp]- [targetUID: 00000000-00007116] "is-UO7PA.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-UO7PA.tmp]- [targetUID: 00000000-00007116] "is-LCD4T.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LCD4T.tmp]- [targetUID: 00000000-00007116] "is-G2P2S.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-G2P2S.tmp]- [targetUID: 00000000-00007116] "is-6H9K6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-6H9K6.tmp]- [targetUID: 00000000-00007116] "is-F4HC9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-F4HC9.tmp]- [targetUID: 00000000-00007116] "is-G7N9B.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-G7N9B.tmp]- [targetUID: 00000000-00007116] "is-KPKA6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-KPKA6.tmp]- [targetUID: 00000000-00007116] "is-COIK5.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-COIK5.tmp]- [targetUID: 00000000-00007116] "is-MCBQ2.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-MCBQ2.tmp]- [targetUID: 00000000-00007116] "is-E84U0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-E84U0.tmp]- [targetUID: 00000000-00007116] "is-OP2F6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-OP2F6.tmp]- [targetUID: 00000000-00007116] "is-C6GCR.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-C6GCR.tmp]- [targetUID: 00000000-00007116] "is-SLHEB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-SLHEB.tmp]- [targetUID: 00000000-00007116] "is-A66A8.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-A66A8.tmp]- [targetUID: 00000000-00007116] "is-VMA3H.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-VMA3H.tmp]- [targetUID: 00000000-00007116] "is-1K1IE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-1K1IE.tmp]- [targetUID: 00000000-00007116] "is-V57CC.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-V57CC.tmp]- [targetUID: 00000000-00007116] "is-BT3OP.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-BT3OP.tmp]- [targetUID: 00000000-00007116] "is-5NIT8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-5NIT8.tmp]- [targetUID: 00000000-00007116] "is-K7GE7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-K7GE7.tmp]- [targetUID: 00000000-00007116] "is-4KKAU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-4KKAU.tmp]- [targetUID: 00000000-00007116] "is-TKVT6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-TKVT6.tmp]- [targetUID: 00000000-00007116] "is-43FPG.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-43FPG.tmp]- [targetUID: 00000000-00007116] "is-LGJ68.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LGJ68.tmp]- [targetUID: 00000000-00007116] "is-BNC0M.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-BNC0M.tmp]- [targetUID: 00000000-00007116] "is-BMMLM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-BMMLM.tmp]- [targetUID: 00000000-00007116] "is-F58IK.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-F58IK.tmp]- [targetUID: 00000000-00007116] "is-7CE1K.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- [targetUID: 00000000-00007116] "is-QCQ4N.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-QCQ4N.tmp]- [targetUID: 00000000-00007116] "is-VMR4I.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-VMR4I.tmp]- [targetUID: 00000000-00007116] "is-ALBNT.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-ALBNT.tmp]- [targetUID: 00000000-00007116] "is-G8OSK.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-G8OSK.tmp]- [targetUID: 00000000-00007116] "is-G3UF9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-G3UF9.tmp]- [targetUID: 00000000-00007116] "is-C7R7M.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-C7R7M.tmp]- [targetUID: 00000000-00007116] "is-241L3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-241L3.tmp]- [targetUID: 00000000-00007116] "is-DSQ48.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-DSQ48.tmp]- [targetUID: 00000000-00007116] "is-3SNGI.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-3SNGI.tmp]- [targetUID: 00000000-00007116] "is-J6LDS.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-J6LDS.tmp]- [targetUID: 00000000-00007116] "is-8H1MB.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-8H1MB.tmp]- [targetUID: 00000000-00007116] "is-3PD71.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-3PD71.tmp]- [targetUID: 00000000-00007116] "is-QFAT9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-QFAT9.tmp]- [targetUID: 00000000-00007116] "is-8F6SM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-8F6SM.tmp]- [targetUID: 00000000-00007116] "is-2JLLL.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-2JLLL.tmp]- [targetUID: 00000000-00007116] "is-D0ATO.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-D0ATO.tmp]- [targetUID: 00000000-00007116] "is-U1AM9.tmp" has type "7-zip archive data version 0.4"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-U1AM9.tmp]- [targetUID: 00000000-00007116] "unins000.dat" has type "InnoSetup Log PassFab iPhone Unlocker {PassFab iPhone Unlocker} version 0x418 48155 bytes KqOSOde4C\KLFbT7L\3 C:\inetpub\PassFab iPhone Unlocker\376\377"- Location: [C:\inetpub\PassFab iPhone Unlocker\unins000.dat]- [targetUID: 00000000-00007116] "is-HDL5L.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-HDL5L.tmp]- [targetUID: 00000000-00007116] "is-CE0T2.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-CE0T2.tmp]- [targetUID: 00000000-00007116] "is-KOP83.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-KOP83.tmp]- [targetUID: 00000000-00007116] "is-FRCB9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-FRCB9.tmp]- [targetUID: 00000000-00007116] "is-DK9PE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-DK9PE.tmp]- [targetUID: 00000000-00007116] "is-OD89A.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-OD89A.tmp]- [targetUID: 00000000-00007116] "is-DM0RC.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-DM0RC.tmp]- [targetUID: 00000000-00007116] "is-G37DJ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-G37DJ.tmp]- [targetUID: 00000000-00007116] "is-FUQ38.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-FUQ38.tmp]- [targetUID: 00000000-00007116] "is-1JGMD.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-1JGMD.tmp]- [targetUID: 00000000-00007116] "is-J79DL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-J79DL.tmp]- [targetUID: 00000000-00007116] "is-98V5L.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-98V5L.tmp]- [targetUID: 00000000-00007116] "is-3L6KM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-3L6KM.tmp]- [targetUID: 00000000-00007116] "is-PV8A9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-PV8A9.tmp]- [targetUID: 00000000-00007116] "is-BEHP8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-BEHP8.tmp]- [targetUID: 00000000-00007116] "is-CE65T.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-CE65T.tmp]- [targetUID: 00000000-00007116] "is-2E2TI.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-2E2TI.tmp]- [targetUID: 00000000-00007116] "is-RTIMT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-RTIMT.tmp]- [targetUID: 00000000-00007116] "is-JOQHS.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-JOQHS.tmp]- [targetUID: 00000000-00007116] "is-5BKLK.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-5BKLK.tmp]- [targetUID: 00000000-00007116] "is-MQABO.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-MQABO.tmp]- [targetUID: 00000000-00007116] "is-M2JHU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-M2JHU.tmp]- [targetUID: 00000000-00007116] "is-DD9C5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-DD9C5.tmp]- [targetUID: 00000000-00007116] "is-35AIF.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-35AIF.tmp]- [targetUID: 00000000-00007116] "is-423HL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-423HL.tmp]- [targetUID: 00000000-00007116] "is-AROVF.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-AROVF.tmp]- [targetUID: 00000000-00007116] "is-MT3VE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-MT3VE.tmp]- [targetUID: 00000000-00007116] "is-P8OOU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-P8OOU.tmp]- [targetUID: 00000000-00007116] "is-TF6SH.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-TF6SH.tmp]- [targetUID: 00000000-00007116] "is-N54SL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-N54SL.tmp]- [targetUID: 00000000-00007116] "is-TMSMO.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-TMSMO.tmp]- [targetUID: 00000000-00007116] "is-G8US8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-G8US8.tmp]- [targetUID: 00000000-00007116] "is-LHMN0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-LHMN0.tmp]- [targetUID: 00000000-00007116] "is-MFOG1.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-MFOG1.tmp]- [targetUID: 00000000-00007116] "is-MMFCS.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-MMFCS.tmp]- [targetUID: 00000000-00007116] "is-GA73U.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-GA73U.tmp]- [targetUID: 00000000-00007116] "is-1UC8K.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-1UC8K.tmp]- [targetUID: 00000000-00007116] "is-52ENU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-52ENU.tmp]- [targetUID: 00000000-00007116] "is-QGNFT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-QGNFT.tmp]- [targetUID: 00000000-00007116] "is-1D9PP.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-1D9PP.tmp]- [targetUID: 00000000-00007116] "is-6PPKU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-6PPKU.tmp]- [targetUID: 00000000-00007116] "is-0HRPT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-0HRPT.tmp]- [targetUID: 00000000-00007116] "is-OS152.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-OS152.tmp]- [targetUID: 00000000-00007116] "is-5SL8J.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-5SL8J.tmp]- [targetUID: 00000000-00007116] "is-2IBH9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-2IBH9.tmp]- [targetUID: 00000000-00007116] "is-BH7Q5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-BH7Q5.tmp]- [targetUID: 00000000-00007116] "is-LDP29.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-LDP29.tmp]- [targetUID: 00000000-00007116] "is-K5RO5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-K5RO5.tmp]- [targetUID: 00000000-00007116] "is-GD1FD.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- [targetUID: 00000000-00007116] "is-F1O5H.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-F1O5H.tmp]- [targetUID: 00000000-00007116] "is-HT34J.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-HT34J.tmp]- [targetUID: 00000000-00007116] "is-93QS8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-93QS8.tmp]- [targetUID: 00000000-00007116] "is-QSBKD.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-QSBKD.tmp]- [targetUID: 00000000-00007116] "is-NI8US.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-NI8US.tmp]- [targetUID: 00000000-00007116] "is-N7NQJ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-N7NQJ.tmp]- [targetUID: 00000000-00007116] "is-NB359.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-NB359.tmp]- [targetUID: 00000000-00007116] "is-F7B6S.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-F7B6S.tmp]- [targetUID: 00000000-00007116] "is-6JSE0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-6JSE0.tmp]- [targetUID: 00000000-00007116] "is-SOEA8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-SOEA8.tmp]- [targetUID: 00000000-00007116] "is-EH3PK.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-EH3PK.tmp]- [targetUID: 00000000-00007116] "is-R11SD.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-R11SD.tmp]- [targetUID: 00000000-00007116] "is-5M9GR.tmp" has type "Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-5M9GR.tmp]- [targetUID: 00000000-00007116] "is-F6J94.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\de.lproj\is-F6J94.tmp]- [targetUID: 00000000-00007116] "is-2AU7K.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\el.lproj\is-2AU7K.tmp]- [targetUID: 00000000-00007116] "is-HSIVO.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\hu.lproj\is-HSIVO.tmp]- [targetUID: 00000000-00007116] "is-FRHB2.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ms.lproj\is-FRHB2.tmp]- [targetUID: 00000000-00007116] "is-LUNH8.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\nl.lproj\is-LUNH8.tmp]- [targetUID: 00000000-00007116] "is-KNF4A.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\it.lproj\is-KNF4A.tmp]- [targetUID: 00000000-00007116] "is-MPTCL.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\es.lproj\is-MPTCL.tmp]- [targetUID: 00000000-00007116] "is-K91KM.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ro.lproj\is-K91KM.tmp]- [targetUID: 00000000-00007116] "is-2DJC7.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\pl.lproj\is-2DJC7.tmp]- [targetUID: 00000000-00007116] "is-CD3BP.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ca.lproj\is-CD3BP.tmp]- [targetUID: 00000000-00007116] "is-DUGR9.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\fr.lproj\is-DUGR9.tmp]- [targetUID: 00000000-00007116] "is-6K7NQ.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\pt_PT.lproj\is-6K7NQ.tmp]- [targetUID: 00000000-00007116] "is-DPUJB.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\sv.lproj\is-DPUJB.tmp]- [targetUID: 00000000-00007116] "is-UA8FN.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\nb.lproj\is-UA8FN.tmp]- [targetUID: 00000000-00007116] "is-DFTH1.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\es_419.lproj\is-DFTH1.tmp]- [targetUID: 00000000-00007116] "is-K2GG8.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\en.lproj\is-K2GG8.tmp]- [targetUID: 00000000-00007116] "is-92IUV.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\id.lproj\is-92IUV.tmp]- [targetUID: 00000000-00007116] "is-7TPJ9.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\pt.lproj\is-7TPJ9.tmp]- [targetUID: 00000000-00007116] "is-ISHR4.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\uk.lproj\is-ISHR4.tmp]- [targetUID: 00000000-00007116] "is-53AR5.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\hr.lproj\is-53AR5.tmp]- [targetUID: 00000000-00007116] "is-HTLMS.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\da.lproj\is-HTLMS.tmp]- [targetUID: 00000000-00007116] "is-QMB4E.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ru.lproj\is-QMB4E.tmp]- [targetUID: 00000000-00007116] "is-0QAFC.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\sk.lproj\is-0QAFC.tmp]- [targetUID: 00000000-00007116] "is-S8230.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\tr.lproj\is-S8230.tmp]- [targetUID: 00000000-00007116] "is-614M1.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\fi.lproj\is-614M1.tmp]- [targetUID: 00000000-00007116] "is-6DCI3.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\cs.lproj\is-6DCI3.tmp]- [targetUID: 00000000-00007116] "is-G9VIT.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\he.lproj\is-G9VIT.tmp]- [targetUID: 00000000-00007116] "is-J8AD3.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\vi.lproj\is-J8AD3.tmp]- [targetUID: 00000000-00007116] "is-RMO1P.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ar.lproj\is-RMO1P.tmp]- [targetUID: 00000000-00007116] "is-F809D.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\th.lproj\is-F809D.tmp]- [targetUID: 00000000-00007116] "is-V3HDA.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ja.lproj\is-V3HDA.tmp]- [targetUID: 00000000-00007116] "is-B8G1I.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\ko.lproj\is-B8G1I.tmp]- [targetUID: 00000000-00007116] "is-NUU54.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\zh_CN.lproj\is-NUU54.tmp]- [targetUID: 00000000-00007116] "is-P15KK.tmp" has type "Unicode text UTF-16 little-endian text with very long lines (396)"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\zh_TW.lproj\is-P15KK.tmp]- [targetUID: 00000000-00007116] "is-KRQ23.tmp" has type "Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-KRQ23.tmp]- [targetUID: 00000000-00007116] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\is-GO4C5.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00007116] "is-0V2R5.tmp" has type "JSON text data"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-0V2R5.tmp]- [targetUID: 00000000-00007116] "is-2VQIK.tmp" has type "JSON text data"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-2VQIK.tmp]- [targetUID: 00000000-00007116] "is-47LI0.tmp" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [C:\inetpub\PassFab iPhone Unlocker\config\is-47LI0.tmp]- [targetUID: 00000000-00007116] "2025-07-22.log" has type "ASCII text with very long lines (375) with CRLF line terminators"- Location: [C:\inetpub\PassFab iPhone Unlocker\Logs\2025-07-22.log]- [targetUID: 00000000-00005840] "is-57J6K.tmp" has type "XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-57J6K.tmp]- [targetUID: 00000000-00007116] "is-2B9AQ.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [C:\inetpub\PassFab iPhone Unlocker\CoreFoundation.resources\is-2B9AQ.tmp]- [targetUID: 00000000-00007116] "is-M83M2.tmp" has type "XML 1.0 document ASCII text with CRLF line terminators"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-M83M2.tmp]- [targetUID: 00000000-00007116] "is-H32K2.tmp" has type "ASCII text with very long lines (344) with no line terminators"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-H32K2.tmp]- [targetUID: 00000000-00007116] "NetFrameCheck.log" has type "Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [C:\inetpub\PassFab iPhone Unlocker\Logs\NetFrameCheck.log]- [targetUID: 00000000-00001192] "is-SVSHM.tmp" has type "Unicode text UTF-16 little-endian text with CRLF line terminators"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-SVSHM.tmp]- [targetUID: 00000000-00007116]4b:Tf57,"is-BG4H1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 2 sections" "is-A1SL3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 12 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-A1SL3.tmp] "is-3G1HJ.tmp" has type "Zip archive data at least v2.0 to extract compression method=store" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-3G1HJ.tmp] "is-MP6HN.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-MP6HN.tmp] "is-BDITL.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-BDITL.tmp] "is-QLVQ0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-QLVQ0.tmp] "is-A1MCP.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-A1MCP.tmp] "is-AQ9IB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-AQ9IB.tmp] "is-4JQOQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 8 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-4JQOQ.tmp] "is-BIV86.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-BIV86.tmp] "is-V7L16.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-V7L16.tmp] "is-M4VTM.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-M4VTM.tmp] "is-LCR95.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 15 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-LCR95.tmp] "is-KD5P6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-KD5P6.tmp] "is-1KKJQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 8 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-1KKJQ.tmp] "is-9BSBF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-9BSBF.tmp] "is-46K6A.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-46K6A.tmp] "is-M495I.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-M495I.tmp] "is-0493E.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 18 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-0493E.tmp] "Setup.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections" - Location: [%TEMP%\is-NI9S7.tmp\Setup.tmp] "is-23FR4.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-23FR4.tmp] "is-7M434.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 7 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-7M434.tmp] "is-GUR4M.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\7z\is-GUR4M.tmp] "is-3JSDU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-3JSDU.tmp] "is-CQCML.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections" - Location: [C:\inetpub\PassFab iPhone Unlocker\is-CQCML.tmp]4c:T490,"Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "Setup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")4d:T127e,"is-BG4H1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 2 sections"- [targetUID: 00000000-00007116] "is-A1SL3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 12 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-A1SL3.tmp]- [targetUID: 00000000-00007116] "is-MP6HN.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-MP6HN.tmp]- [targetUID: 00000000-00007116] "is-QLVQ0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-QLVQ0.tmp]- [targetUID: 00000000-00007116] "is-AQ9IB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-AQ9IB.tmp]- [targetUID: 00000000-00007116] "is-4JQOQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 8 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-4JQOQ.tmp]- [targetUID: 00000000-00007116] "is-BIV86.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-BIV86.tmp]- [targetUID: 00000000-00007116] "is-V7L16.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-V7L16.tmp]- [targetUID: 00000000-00007116] "is-M4VTM.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-M4VTM.tmp]- [targetUID: 00000000-00007116] "is-LCR95.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 15 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LCR95.tmp]- [targetUID: 00000000-00007116] "is-KD5P6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-KD5P6.tmp]- [targetUID: 00000000-00007116] "is-1KKJQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 8 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-1KKJQ.tmp]- [targetUID: 00000000-00007116] "is-9BSBF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-9BSBF.tmp]- [targetUID: 00000000-00007116] "is-46K6A.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-46K6A.tmp]- [targetUID: 00000000-00007116] "is-M495I.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-M495I.tmp]- [targetUID: 00000000-00007116] "is-0493E.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 18 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-0493E.tmp]- [targetUID: 00000000-00007116] "is-23FR4.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-23FR4.tmp]- [targetUID: 00000000-00007116] "is-7M434.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 7 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-7M434.tmp]- [targetUID: 00000000-00007116] "is-GUR4M.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\7z\is-GUR4M.tmp]- [targetUID: 00000000-00007116] "is-3JSDU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-3JSDU.tmp]- [targetUID: 00000000-00007116] "is-CQCML.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-CQCML.tmp]- [targetUID: 00000000-00007116] "is-R3LHR.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-R3LHR.tmp]- [targetUID: 00000000-00007116] "is-LA5M6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 8 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LA5M6.tmp]- [targetUID: 00000000-00007116] "is-NAEV7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-NAEV7.tmp]- [targetUID: 00000000-00007116] "is-CKQ1E.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-CKQ1E.tmp]- [targetUID: 00000000-00007116]4e:Ta91,"Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "SETUP.EXE"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMAIN.SDB"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "DISABLEDOUBLEQUERYSDBS"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\SDBUPDATES"; Key: "SYSMERGE.SDB"; Value: "")4f:T961,"Setup.exe" trying to access non-existent file "C:\Setup.ENU.DLL" "Setup.exe" trying to access non-existent file "C:\Setup.EN.DLL" "Setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-NI9S7.tmp\Setup.ENU.DLL" "Setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-NI9S7.tmp\Setup.EN.DLL" "Setup.tmp" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\unins000.exe" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\PassFab iPhone Unlocker.exe" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\AppService.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\BsSndRpt.exe" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\BugSplat.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\BugSplatDotNet.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\BugSplatRc.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\TSMonitorCLR.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\DllWrapper.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\Downloader.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\EntityFramework.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\EntityFramework.SqlServer.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\FileReport.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\ICSharpCode.SharpZipLib.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\IosManager.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\iTunesEnvFitCLR.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\libcurl.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\log4net.dll" "Setup.tmp" trying to access non-existent file "C:\inetpub\PassFab iPhone Unlocker\Microsoft.Expression.Drawing.dll"50:T7dd,"Setup.exe" trying to access non-existent file "C:\Setup.ENU" "Setup.exe" trying to access non-existent file "C:\Setup.EN" "Setup.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "Setup.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\netmsg.dll.mui" "Setup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-NI9S7.tmp" "Setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-NI9S7.tmp\Setup.ENU" "Setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-NI9S7.tmp\Setup.EN" "Setup.tmp" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "Setup.tmp" trying to access non-existent file "C:\Windows\SysWOW64\en-US\netmsg.dll.mui" "Setup.tmp" trying to access non-existent file "C:\Windows\SystemResources\user32.dll.mun" "Setup.tmp" trying to access non-existent file "C:\Windows\SysWOW64\uxtheme.dll.Config" "Setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-NI9S7.tmp\Setup.tmp.Local\" "Setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-GO4C5.tmp" "Setup.tmp" trying to access non-existent file "C:\Windows\SysWOW64\en-US\PROPSYS.dll.mui" "Setup.tmp" trying to access non-existent file "STORAGE#Volume#{5781f570-2b3b-11ee-88a5-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\" "Setup.tmp" trying to access non-existent file "STORAGE#Volume#{5781f570-2b3b-11ee-88a5-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}" "Setup.tmp" trying to access non-existent file "C:\WINDOWS\system32\cmd.exe:Zone.Identifier" "Setup.tmp" trying to access non-existent file "C:\Windows\SysWOW64\en-US\cmd.exe.mui" "Setup.tmp" trying to access non-existent file "C:\Users\%OSUSER%\Desktop\PassFab iPhone Unlocker.lnk" "Setup.tmp" trying to access non-existent file "C:\Users\Public\Desktop\PassFab iPhone Unlocker.lnk"51:Taca4,Observed string: "!This program cannot be run in DOS mode.;lGv;;4Gv;8Gw;xGv;Gv;Rich.text`.rdata@.data.rsrc@.relocSVRPL$PQL$Lh9|$`sD$LSh:MT$HR9|$,rwP9|$`r5T$LRL$X39|$`rL$LQL$X3(9|$`rD$LPL$X3T$LRL$d_^[3D$HjL$@QL30fD3~WRL$ 5Sh;M9|$w$?3|W2+l$$+T$$+T$T$$+5Pb@T$4+3\$ T$D+W0,&533D$ +3T$ D$,+D$T$$+T$8i1,&5D$4iD$(i\$4i\$8+\$$+\$(+\$<3D$4+D$8D$<+(+D$+D$43+D$<+D$D$,i|$Di|$<3]5%Y3D$,W`17y:+V>OES!35f/X@jhN3OES!i)OES!33L$0T$ +3L$0+3l$03\$0i|$$+3|$03OES!+l$(+\$$+L$$+OES!3OES!+3D$03L$T$ 3L$ OES!3D$05WO-OES!1D$+D$ +Ii3F*OES!3G+T$3T$$3T$0+V3T$(+OES!3OES!+_3D$0SUVD$03T$$+D$03D$0+L$(+0F8gL$D+N3\$ 3D$D+D$ 3L$ L$0iT$D3l$3l$(L$03l$$)L$ D$$+3D$(D$,3T$03FT$D+VT$(i3L$4D$$+D$ 3L$$3D$D3D$,L$43+L$ 3L$DL$(3VA3T$D3D$,3+L$(D$,3L$,+L$$3D$(++T$$+D$4+D$0D$ +1D$$D$$3L$D+N+T$ D$<+T$_^][T$(3T$P\$,3RNs=3L$P+N3D$,3l$PxvQ33l$P59]"T$ iT$ +T$3\$4L$ 3T$0+3T$PAW+T$D$43L$4+D$03T$P33L$PT$ +T$ +D$8i3D$83t$P3D$$iD$D3D$PL$ iL$(+D$ +\$PL$P+L$(\$D33L$,D$P3\$43L$3L$03+D$ +D$ +L$ +3D$P_^3]5ZhSUVWbc~yL$(+O3L$(w%r;3G'a3L$(+OuB{+5CwgG'a3T$(+G'aiG'a33D$(|$(+|$|$(iK+T$DSUVD$<+GD$P+q lbL$ iq lbL$0+\$ +\$6iV3D$0+8>I+3D$ T$ ++D$$+D$,+D$ +T$$++T$(\$(3+T$,L$,+L$8<1L$L$03D$N+L$HiL$P3T$D+L$$iD$P+T$P+|$$3T$0N+N+L$(iT$43l$ i3L$43T$ +L$41l$$+T$T$ 3+L$ 3|$$D$ 3+L$$3D$(T$4G|$TA+|$$v2#+3|$4L$,+L$`3+t$(+T$8+D$8D$(3T$(+L$ iL$(3L$,3+L$ 1L$(L$(33L$,D$`iL$`+3D$ 3L$H+L$$3L$d33L$Hm1yHD$@+1D$,3D$(3D$05m1yHD$LiD$LiD$P3D$H+L$H+L$3D$$_^5L$8SU3!ji*z"(3*z"(i3!j+T$H+Vl$@i5;+NT$H+V-:3T$8l$ iT$0+T$8+T$0+3l$ i3l$8L$8i3L$8L$H+NT$ +t$$gR3D$H5;3FL$<3L$83T$ +T$T$$+T$3\i>3\3+T$$+FT$03D$$+3L$(T$ il$0+3l$0T$ 3L$(3L$ +L$ IL$<33D$$+L$$3D$0c+D$L$<+N+D$|AiT*5T>|A+3L$@l$8iT$Di>|A+3D$<>|A-&+D$,D$(+D$PiD$<+D$$+D$3D$ 5t$,+wD$P3+D$D3D$0D$D+D$$+D$P+G+D$03D$$W3T$P5k>|A+T$0+T$ -3D$PD$$3T$3D$$>|A+L$D3L$P+O>|A+3D$PL$43eo0+D$P+G3L$PD$H+D$D3L$$+D$+l$$3D$L$P+Ol$H+L$ 1T$ L$$3L$8iT$P1T$$L$$3L$<3l$$+L$$3L$4+L$PL$T+L$8+|$ 3D$0++L$)[lL$0iAr(BD$@R2+4n3!TjgAr(BY`#7+Ar(B2+4n+T$p3D$X32+4nL$d+l$<33t$PQ3t$3|$h?+D$`D$ 3,+L$1T$0+L$T$03T$ iL$`iL$|34c|s+T$4+L$0T$ +\$ +,3D$03T$0T$0+\$0+\$TL$ il$T+,+T$3L$pt$03AL$`iY+D$3D$ 3D$05RD$XP+D$XT$ +D$3t$X3\$XL$L3T$Xil$$3L$|+Y3|$+D$$L$ 3L$X++t$XL$t++T$t+D$hT$`+D$ +D$ti\$h+{{k(+L$0D$|3L$0iD$8i,+D$3L$|3D$ F+T$T$H@+l$H3L$L$ 3D$ D$43D$4++L$4L$l3+L$4D$4++T$45\$43T$$3\$83T$tiT$ +\$ ++D$4L$8+L$L$@3L$L3L$4++L$@3T$|+L$43+L$|L$X3L$4@l$L+L$<3T$43+L$+L$+T$0S3j3L$@L$$+T$P3L$<+l$L$<+D$ 33G31T$ T$ 33L$PL$P3+L$$3L$$+D$ +L$D$$+D$P+D$@3D$ @3D$03+D$4+T$$D$0+T$D$D3D$P3T$ D$D33D$ D$4iL$D+L$$L$ 33L$D3L$4T$D3D$H3D$P3+D$ 3D$4T$P+D$P1D$+D$$+D$$+3T$ |$@3D$ +|$8+|$(3|$P3|$43D$8++L$4+T$H+3|$(D$<3|$P,SUV`l4;+V`l4;HR-.T$,i*`l4;i3T$(T$,+T$(i`l4;3D$(`l4;iT$ +3L$43T$(3L$(+L$3D$43D$ `l4;3L$0P+D$(+\$$D$0+T$4+D$ 3`l4;+D$(+L$$++T$$3FT$ +T$3L$(D$ +`l4;+T$05`l4;+D$ +T$8D$8i5`l4;5`l4;+L$0L$,3`l4;+FL$8+L$0+3D$$D$ 3+T$ D$0+T$T$ V3T$8+|$(i3|$$3L$$`l4;`l4;D$$3+D$(++l$ 3l$(D$0PT$0+T$ T$0+T$3|$ _^][SUV3L$<3L$D+_^][tG9}0WWWWW_^[]tVPWWWWWIf90tWSj0WSj t&:aSSSSSSSSSSHH_^[SSSSSSSSSS^_[3=upFSSSSSURPQQhL$,3UVWS[_^]SVWj_^[]j@j ^V[j@j 9=PoVVVVVPPPPP@u^Vt$HHtHHtYHHtHHty+RPSW90tWWSj0WSj VVVVWWWWW~,WPV98t^tVPVt/9U>=Yt1jtNVSPPPPPPY[_^>"u&< tKcsmtaSVYYPVt)SVHu4j>MOCs[S;7|G;w9>u&tR99u2r 9Y@_^[]oV fo^0fof@fonPfov`fo~pf_^[]Y_^[Y_^[j hXYt+HtPPPPP_^[]0SSSSSVVVVVu8SS3GWhX;9] u9]$SSt)9]t"SS9]9] uFVhX;9] SS;58~v$;5T~PPPPPPPPtR:Qt<:Qt&:QPPPPPPPPWWWWWuaVjuL9=wIVSPFVSjVVVVV^SSSSSj"^SSSSSQSWVjvN+D$WWWWWWWWWWVVVVVVVVVVVVhUWWWWWSSSSStGHt.Ht&^SSSSS;t0;8VVVVVt(9uSSSSSSSSSSti9]6f;pr0f;ptH9]6f;Hr0f;Hu!f;t9]SSSSSSSSSStA9]t_8]t 9]SVWUj]_^[;t$,v-UQPXY]Y[VW|[;_^[]VVVVVj@j SSSSSWWWWVtRuntime Error!Program: !"#$%&'()*+ -./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~EncodePointerDecodePointerFlsFreeFlsSetValueFlsGetValueFlsAlloc(null)( 8PX700WP`h````xpxxxxUTF-8UTF-16LEUNICODE('8PW700PP`h`hhhxppwppbad exceptionGetProcessWindowStationGetUserObjectInformationAGetLastActivePopupGetActiveWindowMessageBoxAUSER32.DLL !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuarySaturdayFridayThursdayWednesdayTuesdayMondaySunday Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'operator delete new__unaligned__restrict__ptr64__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(SunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecCONOUT$vRQ>8STsLwH'bad allocationFailed to create CURL connectioncloudcloudFailed to set connection time out [%d]Failed to set time out [%d]Failed to set CURLOPT_WRITEFUNCTION [%d]Failed to set CURLOPT_WRITEDATA [%d]Failed to CURLOPT_FOLLOWLOCATION [%d]Failed to set CURLOPT_URL [%d]Failed to set CURLOPT_HTTPHEADER [%d]Failed to set CURLOPT_POST [%d]Failed to perform request [%d]Failed to perform request [%d]Failed to set error buffer [%d]Failed to set CURLOPT_HTTPHEADER [%d]Failed to set CURLOPT_POST [%d]Failed to set CURLOPT_POSTFIELDSIZE [%d]Failed to set CURLOPT_POSTFIELDS [%d]Failed to perform request [%d]Failed to perform request [%d]bad allocation\Logs\.log[%u/%u/%u-%u:%u:%u] \Logs\.log[%u/%u/%u-%u:%u:%u] \*.*%s\%s\Logsbad allocationhttp://t" (Indicator: " curl ") in Source: is-6F73G.tmp Observed string: "!This program cannot be run in DOS mode.Rich.text`.rdata@.data.rsrc@.relocY_^[WUQPD$,dD$@3t$If90tWSj0WSj SSSSSSSSSSHH_^[SSSSSSSSSS@_^]=MOC=csm8csm9csm~SSVj,hp~@;H>csmtaSVYYPVt)SVHu4j>MOCs[S;7|G;w9>u&YYh4tR99u2r,9Y@_^[]t$hDtehIWWWWWVVVVV~,WPV98t^tVPVt/9UY__^[9csmt h$uNSWj@j ^V[j@j PPPPP@u^Vt$HHtHHtYHHtHHty+RPSW90tWWSj0WSj VVVV=upFSSSSSURPQQh8L$,3UVWS[_^]SVWj_^[]u,9EWWWWWVVVVVPPPPP=Yt1jtNVSPPPPPPY[_^>"u&< tKRuntime Error!Program: !"#$%&'()*+ -./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'operator delete new__unaligned__restrict__ptr64__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(GetProcessWindowStationGetUserObjectInformationAGetLastActivePopupGetActiveWindowMessageBoxAUSER32.DLL !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuarySaturdayFridayThursdayWednesdayTuesdayMondaySundaySunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecCONOUT$curl_easy_cleanupcurl_easy_getinfocurl_easy_performcurl_slist_appendcurl_easy_setoptcurl_easy_initlibcurl.dllGetModuleFileNameAGetLocalTimeLeaveCriticalSectionEnterCriticalSectionGetTickCountSleepInitializeCriticalSectionCreateThreadGetProcAddressGetModuleHandleWGetVersionExWGetSystemInfoWideCharToMultiByteGetComputerNameWGetLastErrorlstrlenAGetVolumeInformationAGetSystemDirectoryAKERNEL32.dllGetSystemMetricsUSER32.dllRegCloseKeyRegSetValueExARegCreateKeyExARegQueryValueExARegOpenKeyExAADVAPI32.dllCoCreateGuidole32.dllWS2_32.dllGetAdaptersInfoIPHLPAPI.DLLInternetReadFileHttpQueryInfoWInternetCloseHandleInternetOpenUrlAInternetSetOptionWInternetOpenAInternetGetConnectedStateWININET.dlltimeGetTimeWINMM.dllRaiseExceptionRtlUnwindTerminateProcessGetCurrentProcessUnhandledExceptionFilterSetUnhandledExceptionFilterIsDebuggerPresentHeapFreeHeapAllocGetCurrentThreadIdGetCommandLineATlsGetValueTlsAllocTlsSetValueTlsFreeInterlockedIncrementSetLastErrorInterlockedDecrementCloseHandleSetHandleCountGetStdHandleGetFileTypeGetStartupInfoADeleteCriticalSectionHeapSizeExitProcessWriteFileHeapCreateHeapDestroyVirtualFreeVirtualAllocHeapReAllocGetCPInfoGetACPGetOEMCPIsValidCodePageFreeEnvironmentStringsAGetEnvironmentStringsFreeEnvironmentStringsWGetEnvironmentStringsWQueryPerformanceCounterGetCurrentProcessIdGetSystemTimeAsFileTimeSetFilePointerGetConsoleCPGetConsoleModeSetStdHandleFlushFileBuffersInitializeCriticalSectionAndSpinCountCreateFileALoadLibraryAGetLocaleInfoALCMapStringAMultiByteToWideCharLCMapStringWGetStringTypeAGetStringTypeWWriteConsoleAGetConsoleOutputCPWriteConsoleWSetEndOfFileGetProcessHeapReadFileSoftwareLog.dllCreateExportObjDestroyExportObjNSISLog.?AVbad_alloc@std@@.?AVexception@std@@.?AVIWebLog@@.?AVWebLog@@.?AVlogic_error@std@@.?AVlength_error@std@@.?AVout_of_range@std@@.?AVtype_info@@.?AVbad_exception@std@@ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX879F9u9<-,>?>D>T>x>?/?S?b?0#0(0P1]1v2435=5I5q5~5:S;d;<+<0<6)>7>P>`>g>y>? ?$?(?F>~>0c1u11*2d2{23R3^3m3y35#6q67)72787C7U7g708v8}88C;V;k>;BU>g>263(44#959G99#:\:S=e=w=3B3t36N8x8<1=k?0 0O0\0o00#1H1e1B2V2323]36'6W6]6e6r6l>y>w0p1v12$282?2W2c2i2u23A3V3|34&4L44+5356 6'6-646:6B6I6N6V6_6k6p6u6{6787>7Z7v7:U:_:w:< =a=g=>,>A>K>q>l0t00H1Z1363w3454S4u4526F6l6:3Mp$d}4}L!xE.IpB26*f(_[K]taM?m&vhJ>@G_#!Y`x8E0SA|X=Gq]dLk0i0$http://ocsp.digicert.com0A5http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C<0:082http://crl3.digicert.com/DigiCertTrustedRootG4.crl0:#D=:]Hmv~7q!usRov7,/"lAjj@0HK4VxN0DigiCert Inc.1A0?8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10210707000000Z240711235959Z0^1Wan Chai1Tenorshare Co. Ltd.1Tenorshare Co. Ltd.00NFG@iG@-.0xq5#&$e5Mqo'r68R"rG|Z[\k>w/z0]viL.Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0SMhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>705030)0'http://www.digicert.com/CPS0http://ocsp.digicert.com0\Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0Oc Acu@+Rb^WlKM'0}?jiAbx\"+J20}0i1DigiCert, Inc.1A0?8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA13D!>Mp$d}4}L!xE.IpB26*f(_[K]taM?m&vhJ>@G_#!Y`x8E0SA|X=Gq]dLk0i0$http://ocsp.digicert.com0A5http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C<0:082http://crl3.digicert.com/DigiCertTrustedRootG4.crl0:#D=:]Hmv~7q!usRov7,/"lAjj@0HK4VxN0DigiCert, Inc.1A0?8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10210707000000Z240711235959Z0^1Wan Chai1T" (Indicator: " curl ") in Source: is-C6GCR.tmp, Observed string: "!This program cannot be run in DOS mode.Rich.text`.rdata@.data.rsrc@.relocY_^[WUQPD$,dD$@3t$If90tWSj0WSj SSSSSSSSSSHH_^[SSSSSSSSSS@_^]=MOC=csm8csm9csm~SSVj,hp~@;H>csmtaSVYYPVt)SVHu4j>MOCs[S;7|G;w9>u&YYh4tR99u2r,9Y@_^[]t$hDtehIWWWWWVVVVV~,WPV98t^tVPVt/9UY__^[9csmt h$uNSWj@j ^V[j@j PPPPP@u^Vt$HHtHHtYHHtHHty+RPSW90tWWSj0WSj VVVV=upFSSSSSURPQQh8L$ 3UVWS[_^]SVWj_^[]u 9EWWWWWVVVVVPPPPP=Yt1jtNVSPPPPPPY[_^>"u&< tKRuntime Error!Program: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ Complete Object Locator' Class Hierarchy Descriptor' Base Class Array' Base Class Descriptor at ( Type Descriptor'`local static thread guard'`managed vector copy constructor iterator'`vector vbase copy constructor iterator'`vector copy constructor iterator'`dynamic atexit destructor for '`dynamic initializer for '`eh vector vbase copy constructor iterator'`eh vector copy constructor iterator'`managed vector destructor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`udt returning'`copy constructor closure'`eh vector vbase constructor iterator'`eh vector destructor iterator'`eh vector constructor iterator'`virtual displacement map'`vector vbase constructor iterator'`vector destructor iterator'`vector constructor iterator'`scalar deleting destructor'`default constructor closure'`vector deleting destructor'`vbase destructor'`string'`local static guard'`typeof'`vcall'`vbtable'`vftable'operator delete new__unaligned__restrict__ptr64__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based(GetProcessWindowStationGetUserObjectInformationAGetLastActivePopupGetActiveWindowMessageBoxAUSER32.DLL !"#$%&'()*+ -./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~ !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~HH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuarySaturdayFridayThursdayWednesdayTuesdayMondaySundaySunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecCONOUT$curl_easy_cleanupcurl_easy_getinfocurl_easy_performcurl_slist_appendcurl_easy_setoptcurl_easy_initlibcurl.dllGetModuleFileNameAGetLocalTimeLeaveCriticalSectionEnterCriticalSectionGetTickCountSleepInitializeCriticalSectionCreateThreadGetProcAddressGetModuleHandleWGetVersionExWGetSystemInfoWideCharToMultiByteGetComputerNameWGetLastErrorlstrlenAGetVolumeInformationAGetSystemDirectoryAKERNEL32.dllGetSystemMetricsUSER32.dllRegCloseKeyRegSetValueExARegCreateKeyExARegQueryValueExARegOpenKeyExAADVAPI32.dllCoCreateGuidole32.dllWS2_32.dllGetAdaptersInfoIPHLPAPI.DLLInternetReadFileHttpQueryInfoWInternetCloseHandleInternetOpenUrlAInternetSetOptionWInternetOpenAInternetGetConnectedStateWININET.dlltimeGetTimeWINMM.dllRaiseExceptionRtlUnwindTerminateProcessGetCurrentProcessUnhandledExceptionFilterSetUnhandledExceptionFilterIsDebuggerPresentHeapFreeHeapAllocGetCurrentThreadIdGetCommandLineATlsGetValueTlsAllocTlsSetValueTlsFreeInterlockedIncrementSetLastErrorInterlockedDecrementCloseHandleSetHandleCountGetStdHandleGetFileTypeGetStartupInfoADeleteCriticalSectionHeapSizeExitProcessWriteFileHeapCreateHeapDestroyVirtualFreeVirtualAllocHeapReAllocGetCPInfoGetACPGetOEMCPIsValidCodePageFreeEnvironmentStringsAGetEnvironmentStringsFreeEnvironmentStringsWGetEnvironmentStringsWQueryPerformanceCounterGetCurrentProcessIdGetSystemTimeAsFileTimeSetFilePointerGetConsoleCPGetConsoleModeSetStdHandleFlushFileBuffersInitializeCriticalSectionAndSpinCountCreateFileALoadLibraryAGetLocaleInfoALCMapStringAMultiByteToWideCharLCMapStringWGetStringTypeAGetStringTypeWWriteConsoleAGetConsoleOutputCPWriteConsoleWSetEndOfFileGetProcessHeapReadFileSoftwareLog.dllCreateExportObjDestroyExportObjNSISLog.?AVbad_alloc@std@@.?AVexception@std@@.?AVIWebLog@@.?AVWebLog@@.?AVlogic_error@std@@.?AVlength_error@std@@.?AVout_of_range@std@@.?AVtype_info@@.?AVbad_exception@std@@ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX879F9u9<-,>?>D>T>x>?/?S?b?0#0(0P1]1v2435=5I5q5~5:S;d;<+<0<6)>7>P>`>g>y>? ?$?(?F>~>0c1u11*2d2{23R3^3m3y35#6q67)72787C7U7g708v8}88C;V;k>;BU>g>263(44#959G99#:\:S=e=w=3B3t36N8x8<1=k?0 0O0\0o00#1H1e1B2V2323]36'6W6]6e6r6l>y>w0p1v12$282?2W2c2i2u23A3V3|34&4L44+5356 6'6-646:6B6I6N6V6_6k6p6u6{6787>7Z7v7:U:_:w:< =a=g=>,>A>K>q>l0t00H1Z1363w3454S4u4526F6l6:3Mp$d}4}L!xE.IpB26*f(_[K]taM?m&vhJ>@G_#!Y`x8E0SA|X=Gq]dLk0i0$http://ocsp.digicert.com0A5http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C<0:082http://crl3.digicert.com/DigiCertTrustedRootG4.crl0:#D=:]Hmv~7q!usRov7,/"lAjj@0HK4VxN0DigiCert Inc.1A0?8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10210707000000Z240711235959Z0^1Wan Chai1Tenorshare Co. Ltd.1Tenorshare Co. Ltd.00NFG@iG@-.0xq5#&$e5Mqo'r68R"rG|Z[\k>w/z0]viL.Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0SMhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>705030)0'http://www.digicert.com/CPS0http://ocsp.digicert.com0\Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0Oc Acu@+Rb^WlKM'0}?jiAbx\"+J20}0i1DigiCert, Inc.1A0?8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA13D!>Mp$d}4}L!xE.IpB26*f(_[K]taM?m&vhJ>@G_#!Y`x8E0SA|X=Gq]dLk0i0$http://ocsp.digicert.com0A5http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C<0:082http://crl3.digicert.com/DigiCertTrustedRootG4.crl0:#D=:]Hmv~7q!usRov7,/"lAjj@0HK4VxN0DigiCert Inc.1A0?8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10210707000000Z240711235959Z0^1Wan Chai1Tenorshare Co. Ltd" (Indicator: " curl ") in Source: is-SLHEB.tmp52:Tda6,Found reference to API "User chose not to shutdown applications using our files." (Indicator: " shutdown "; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "Setup.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "Setup.exe") Found reference to API "gethostname" (Indicator: "gethostname"; File: "Setup.exe") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "Setup.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "Setup.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "Setup.exe") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "Setup.exe") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "Setup.exe") Found reference to API "Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation." (Indicator: " accept "; Source: "00000000-00003816.00000000.152180.026C0000.00000004.mdmp, 00000000-00003816.00000001.154097.00C20000.00000002.mdmp") Found reference to API "I &do not accept the agreement" (Indicator: " accept "; Source: "00000000-00003816.00000000.152180.026C0000.00000004.mdmp, 00000000-00003816.00000001.154097.00C20000.00000002.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00005840.00000000.155743.02CD0000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00005840.00000000.155743.02CD0000.00000004.mdmp") Found reference to API "t accept the agreement" (Indicator: " accept "; Source: "00000000-00005840.00000000.155743.03360000.00000002.mdmp") Found reference to API "ead the following License Agreement. You must accept the terms of this agreement before continuing with the installation." (Indicator: " accept "; Source: "00000000-00005840.00000000.155743.03360000.00000002.mdmp") Found reference to API "ecurity Exception (ControlAppDomain LinkDemand) while trying to register Shutdown handler with the AppDomain. LoggerManager.Shutdown() will not be called automatically when the AppDomain exits. It must be called programmatically." (Indicator: " shutdown "; Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp") Found reference to API "nable to send logging event to remote syslog" (Indicator: " send "; Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp") Found reference to API "failed to send all queued events before close, in OnClose." (Indicator: " send "; Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp") Found reference to API "reating SocketHandler to listen on port [" (Indicator: " listen "; Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp") Found reference to API "nable to send logging event to remote host" (Indicator: " send "; Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp") Found reference to API "GetHostName" (Indicator: "gethostname"; Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp") Found reference to API "User chose not to shutdown applications using our files." (Indicator: " shutdown "; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp")53:Td70,Found URL "http://www.dk-soft.org/" - Source: "00000000-00003816.00000000.152180.026C0000.00000004.mdmp") Found URL "https://www.passfab.com/https://www.passfab.com/https://www.passfab.com/setup" - Source: "00000000-00003816.00000000.152180.026C0000.00000004.mdmp") Found URL "https://www.passfab.com" - Source: "00000000-00003816.00000000.152180.026C0000.00000004.mdmp") Found URL "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlinesetupernel32.dlluxtheme.dlluserenv.dllsetupapi.dllapphelp.dllpropsys.dlldwmapi.dllcryptbase.dlloleacc.dllversion.dllprofapi.dllcomres.dllclbcatq.dllwow64disablewow64fsredirectionkernel32.dllwow64revertwow64fsredirectionshell32.dlljjjjjj.tmpinnosetupldrwindowstatic/sl5=" - Source: "00000000-00003816.00000001.154097.00401000.00000020.mdmp") Found URL "http://logging.apache.org/log4net/release/faq.html" - Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp") Found URL "http://www.innosetup.com/remobjects" - Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found URL "http://www.remobjects.com/psexception" - Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00007116.00000000.152239.02840000.00000004.mdmp") Found URL "https://www.passfab.com/https://www.passfab.com/https://www.passfab.com/create" - Source: "00000000-00007116.00000000.152239.02840000.00000004.mdmp") Found URL "http://cbs.passfab.com/go?pid=1752&a=uihttp://cbs.passfab.com/go?pid=1979&a=uihttp://cbs.passfab.com/go?pid=2215&a=uihttp://cbs.passfab.com/go?pid=1977&a=uihttp://cbs.passfab.com/go?pid=2016&a=uihttp://cbs.passfab.com/go?pid=1983&a=uihttp://cbs.passfab.com/go?pid=1966&a=uihttp://cbs.passfab.com/go?pid=2083&a=uihttp://cbs.passfab.com/go?pid=1752&a=uihttp://cbs.passfab.com/go?pid=1752&a=uihttp://cbs.passfab.com/go?pid=1962&a=uihttp://cbs.passfab.com/go?pid=1752&a=uiassertion" - Source: "00000000-00007116.00000000.152239.02840000.00000004.mdmp") Found URL "https://www.passfab.com_a*" - Source: "00000000-00007116.00000000.152239.02840000.00000004.mdmp") Found URL "https://www.passfab.comtahomatahoma" - Source: "00000000-00007116.00000001.154161.005D0000.00000004.mdmp") Found URL "https://www.passfab.comre\microsoft\windows" - Source: "00000000-00007116.00000001.154161.005D0000.00000004.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00007116.00000001.154161.02840000.00000004.mdmp") Found URL "https://www.passfab.com/https://www.passfab.com/https://www.passfab.com/create" - Source: "00000000-00007116.00000001.154161.02840000.00000004.mdmp") Found URL "http://cbs.passfab.com/go?pid=1752&a=uihttp://cbs.passfab.com/go?pid=1979&a=uihttp://cbs.passfab.com/go?pid=2215&a=uihttp://cbs.passfab.com/go?pid=1977&a=uihttp://cbs.passfab.com/go?pid=2016&a=uihttp://cbs.passfab.com/go?pid=1983&a=uihttp://cbs.passfab.com/go?pid=1966&a=uihttp://cbs.passfab.com/go?pid=2083&a=uihttp://cbs.passfab.com/go?pid=1752&a=uihttp://cbs.passfab.com/go?pid=1752&a=uihttp://cbs.passfab.com/go?pid=1962&a=uihttp://cbs.passfab.com/go?pid=1752&a=uic:\program" - Source: "00000000-00007116.00000001.154161.02840000.00000004.mdmp") Found URL "https://www.passfab.comifpsbooleantmsgboxtypetwizardformtwizardformtnewradiobuttontnewradiobuttontexecwait!mainredesignwizardformmsgboxinitializewizardwizardformclass:twizardform" - Source: "00000000-00007116.00000001.154161.02840000.00000004.mdmp")54:T646,YARA signature for RC4 encryption matched on file "is-M495I.tmp" YARA signature for RC4 encryption matched on process "00000000-00007116" YARA signature for RC4 encryption matched on file "is-F58IK.tmp" YARA signature for RC4 encryption matched on file "is-DSQ48.tmp" YARA signature for RC4 encryption matched on file "is-F98U6.tmp" YARA signature for RC4 encryption matched on file "is-4KKAU.tmp" YARA signature for RC4 encryption matched on file "is-33TGT.tmp" YARA signature for RC4 encryption matched on file "is-N72LL.tmp" YARA signature for RC4 encryption matched on file "is-6F73G.tmp" YARA signature for RC4 encryption matched on file "is-CKQ1E.tmp" YARA signature for RC4 encryption matched on file "is-OGC2S.tmp" YARA signature for RC4 encryption matched on process "00000000-00005840" YARA signature for RC4 encryption matched on process "00000000-00003816" YARA signature for RC4 encryption matched on file "is-R9L1J.tmp" YARA signature for RC4 encryption matched on file "is-7M434.tmp" YARA signature for RC4 encryption matched on file "is-V57CC.tmp" YARA signature for RC4 encryption matched on file "is-M4VTM.tmp" YARA signature for RC4 encryption matched on file "is-D7A3P.tmp" YARA signature for RC4 encryption matched on file "is-BIV86.tmp" YARA signature for RC4 encryption matched on file "is-V7L16.tmp" YARA signature for RC4 encryption matched on file "is-5N14N.tmp" YARA signature for RC4 encryption matched on file "is-A1SL3.tmp" YARA signature for RC4 encryption matched on file "is-BMMLM.tmp" YARA signature for RC4 encryption matched on file "is-R3LHR.tmp"55:T85e,"Setup.tmp" called "FindFirstFileW" with parameter %TEMP%\is-NI9S7.tmp\Setup.tmp (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter Setup.tmp (UID: 00000000-00007116) "Setup.tmp" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter $WinREAgent (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter Config.Msi (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter Documents and Settings (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter DumpStack.log.tmp (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter hiberfil.sys (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter inetpub (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter MSOCache (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter pagefile.sys (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter PerfLogs (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter Program Files (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter Program Files (x86) (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter ProgramData (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter Recovery (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter Setup.exe (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter swapfile.sys (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter System Volume Information (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter tempdir (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter Users (UID: 00000000-00007116) "Setup.tmp" called "FindNextFileW" with parameter Windows (UID: 00000000-00007116) "Setup.tmp" called "FindFirstFileW" with parameter C:\$WinREAgent\* (UID: 00000000-00007116)56:T729,Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "Setup.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "Setup.exe") Found reference to API "RegOpenKeyEx" (Indicator: "RegOpenKey"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" (Indicator: "RegGetValue"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; File: "Setup.exe") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; File: "Setup.exe") Found reference to API "RegQueryValueW" (Indicator: "RegQueryValue"; File: "Setup.exe") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "Setup.exe") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "Setup.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "Setup.exe") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; File: "Setup.exe") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; File: "Setup.exe") Found reference to API "RegOpenKeyW" (Indicator: "RegOpenKey"; File: "Setup.exe") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; File: "Setup.exe") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003816.00000000.152180.00412000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003816.00000000.152180.00412000.00000004.mdmp") Found reference to API "RegOpenKeyEx" (Indicator: "RegOpenKey"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp")57:T429,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "Setup.exe") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "Setup.exe") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "Setup.exe") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "Setup.exe") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "Setup.exe") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "Setup.exe") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "Setup.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "Setup.exe") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003816.00000000.152180.00412000.00000004.mdmp")58:T958,"Inno Setup Uninstall Log (b){PassFab iPhone Unlocker}PassFab iPhone UnlockerIFPSBOOLEANTMSGBOXTYPETWIZARDFORMTWIZARDFORMTNEWRADIOBUTTONTNEWRADIOBUTTONTEXECWAIT!MAINREDESIGNWIZARDFORMMSGBOXINITIALIZEWIZARDWIZARDFORMclass:TWIZARDFORM|LICENSEACCEPTEDRADIO|class:TRADIOBUTTON|CHECKED@|COMPAREVERSION11 @17 @17STRTOINTCOPYDELETEUNINSTALLOLDVERSIONIS64BITINSTALLMODEREGQUERYSTRINGVALUEDIREXISTSDELTREEINITIALIZESETUPSHELLEXECEXPANDCONSTANTDELETEFILEnotepad.exe is running. Please close the application before running the installer SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1DisplayVersion3.0.4.99UninstallStringInstallLocation/c taskkill /f /t /im "PassFab iPhone Unlocker.exe"{cmd}open{userdesktop}\PassFab iPhone Unlocker.lnk{commondesktop}\PassFab iPhone Unlocker.lnk" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: unins000.dat "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 64710-1007-004D9AC0 "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 64710-1081-004D26F0 "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 64710-4757-004CD61C "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003816.00000000.152180.026C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00003816.00000000.152180.026C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007116.00000000.152239.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007116.00000000.152239.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007116.00000000.152239.00401000.00000020.mdmp59:T5f5,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "Setup.exe") file/memory contains long string with (Indicator: "OpenProcess"; File: "is-VT143.tmp") file/memory contains long string with (Indicator: "OpenProcess"; File: "is-F98U6.tmp") file/memory contains long string with (Indicator: "OpenProcess"; File: "is-LCD4T.tmp") file/memory contains long string with (Indicator: "OpenProcess"; File: "is-BT3OP.tmp") file/memory contains long string with (Indicator: "OpenProcess"; File: "is-241L3.tmp") file/memory contains long string with (Indicator: "OpenProcess"; File: "is-2E2TI.tmp") file/memory contains long string with (Indicator: "OpenProcess"; File: "is-MFOG1.tmp") file/memory contains long string with (Indicator: "OpenProcess"; File: "is-NI8US.tmp") Found string "OpenProcessTokenW" (Indicator: "OpenProcess"; Source: "00000000-00005840-00000C2B-1430501972") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005840-00000C2B-1432364851") Found string "OpenProcessW" (Indicator: "OpenProcess"; Source: "00000000-00005840-00000C2B-1432364886") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003816.00000000.152180.00412000.00000004.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp")5a:T629,Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\is-NI9S7.tmp\Setup.tmp" (Indicator: "\Device\"; Source: "00000000-00003816-00000BC0-1373995745") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00007924-00000BC0-1382386606") Found string "\Device\HarddiskVolume3\Windows\SysWOW64\taskkill.exe" (Indicator: "\Device\"; Source: "00000000-00007924-00000BC0-1382882380") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003816.00000000.152180.00880000.00000004.mdmp, 00000000-00003816.00000001.154097.005A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003816.00000000.152180.00880000.00000004.mdmp, 00000000-00003816.00000001.154097.005A0000.00000004.mdmp") Found string "stem32\Drivers\(" (Indicator: "\drivers\"; Source: "00000000-00003816.00000001.154097.005A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005840.00000000.155743.02CD0000.00000004.mdmp, 00000000-00005840.00000000.155743.02F70000.00000004.mdmp, 00000000-00005840.00000000.155743.02FC0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005840.00000000.155743.02CD0000.00000004.mdmp, 00000000-00005840.00000000.155743.02F70000.00000004.mdmp, 00000000-00005840.00000000.155743.02FC0000.00000004.mdmp")5b:T50a,Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" (Indicator: "RegDeleteKey"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" (Indicator: "RegDeleteKey"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" (Indicator: "RegDeleteValue"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "Setup.exe") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "Setup.exe") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp, 00000000-00007116.00000001.154161.72DA1000.00000020.mdmp") Found reference to API "RegDeleteKeyExA" (Indicator: "RegDeleteKey"; Source: "00000000-00007116.00000000.152239.00401000.00000020.mdmp")5c:T569,Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "00000000-00007116.00000000.152239.00401000.00000020.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "Setup.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "Setup.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "Setup.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "Setup.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "Setup.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "Setup.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "Setup.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "Setup.exe") Found reference to API "ailed to DuplicateToken after LogonUser. Error:" (Indicator: "DuplicateToken"; Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp") Found reference to API "DuplicateTokenHandle" (Indicator: "DuplicateToken"; Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00005840.00000000.155743.09C12000.00000002.mdmp")5d:T53a,Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: is-BIV86.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Setup.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: Setup.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Setup.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Setup.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: Setup.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Setup.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: Setup.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: is-23FR4.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: is-23FR4.tmp]5e:Ta0c,"Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "Setup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IS-NI9S7.TMP\SETUP.TMP"; Value: "") "Setup.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "Setup.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "Setup.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\INETPUB\PASSFAB IPHONE UNLOCKER\START.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\TASKKILL.EXE"; Value: "") "Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "Start.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\INETPUB\PASSFAB IPHONE UNLOCKER\PASSFAB IPHONE UNLOCKER.EXE"; Value: "") "PassFab iPhone Unlocker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "PassFab iPhone Unlocker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "PassFab iPhone Unlocker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "PassFab iPhone Unlocker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "RECVBUFFERSIZE"; Value: "") "PassFab iPhone Unlocker.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "DISABLETLS1.3"; Value: "")5f:T43a,"Setup.exe" was detected as "Borland Delphi 4.0" "is-A1MCP.tmp" was detected as "VC8 -> Microsoft Corporation" "is-4JQOQ.tmp" was detected as "Microsoft visual C++ 8.0" "is-BIV86.tmp" was detected as "Borland Delphi 3.0 (???)" "is-V7L16.tmp" was detected as "Borland Delphi 3.0 (???)" "is-M4VTM.tmp" was detected as "Borland Delphi 3.0 (???)" "is-LCR95.tmp" was detected as "Visual C++ 2005 DLL -> Microsoft" "is-1KKJQ.tmp" was detected as "Microsoft visual C++ 8.0" "is-9BSBF.tmp" was detected as "Borland Delphi 3.0 (???)" "is-46K6A.tmp" was detected as "Borland Delphi 3.0 (???)" "is-M495I.tmp" was detected as "Visual C++ 2005 DLL -> Microsoft" "Setup.tmp" was detected as "Borland Delphi 4.0" "is-23FR4.tmp" was detected as "Borland Delphi 3.0 (???)" "is-7M434.tmp" was detected as "Microsoft visual C++ 8.0" "is-GUR4M.tmp" was detected as "Microsoft visual C++ 6.0 DLL" "is-3JSDU.tmp" was detected as "Visual C++ 2005 DLL -> Microsoft" "is-CQCML.tmp" was detected as "Visual C++ 2005 DLL -> Microsoft" "is-R3LHR.tmp" was detected as "Borland Delphi 3.0 (???)"60:T710,"Setup.exe" has section name .text with entropy "6.3752135040515485" "Setup.exe" has section name .rsrc with entropy "6.180970870831664" "is-A1MCP.tmp" has section name .text with entropy "6.501188753073416" "is-A1MCP.tmp" has section name .rsrc with entropy "7.791802769229867" "is-A1MCP.tmp" has section name .reloc with entropy "6.564449431789936" "is-4JQOQ.tmp" has section name .reloc with entropy "6.516909474092782" "is-BIV86.tmp" has section name .text with entropy "6.534317159872575" "is-BIV86.tmp" has section name .rdata with entropy "6.119484540713241" "is-BIV86.tmp" has section name .reloc with entropy "6.807119480063394" "is-V7L16.tmp" has section name .text with entropy "6.46118383164221" "is-V7L16.tmp" has section name .rsrc with entropy "7.041007073733689" "is-V7L16.tmp" has section name .reloc with entropy "6.821869658925938" "is-M4VTM.tmp" has section name .text with entropy "6.456219887041371" "is-M4VTM.tmp" has section name .reloc with entropy "6.70404568706098" "is-LCR95.tmp" has section name .text with entropy "6.5821246281235615" "is-LCR95.tmp" has section name .debug_i with entropy "6.004545384541184" "is-LCR95.tmp" has section name .debug_l with entropy "6.290908505272373" "is-LCR95.tmp" has section name .reloc with entropy "6.238746876366523" "is-KD5P6.tmp" has section name .text with entropy "6.129901236349641" "is-KD5P6.tmp" has section name .reloc with entropy "6.517440795032536" "is-1KKJQ.tmp" has section name .reloc with entropy "6.47766005147779" "is-9BSBF.tmp" has section name .text with entropy "6.6191346241757385" "is-9BSBF.tmp" has section name .reloc with entropy "6.092787805691832" "is-46K6A.tmp" has section name .text with entropy "6.189319259942213" "is-46K6A.tmp" has section name .data with entropy "7.913489874499702"61:T427,"Setup.tmp" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "Setup.tmp" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "Setup.tmp" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "Setup.tmp" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "Setup.tmp" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "Setup.tmp" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "Setup.tmp" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "Setup.tmp" reads file "C:\Program Files\desktop.ini" "Setup.tmp" reads file "C:\Program Files (x86)\desktop.ini" "Setup.tmp" reads file "C:\Users\desktop.ini" "Start.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "Start.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "Start.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "Start.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "Start.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "Start.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "Start.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini"62:T7fde,"is-BG4H1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 2 sections"- [targetUID: 00000000-00007116] "is-A1SL3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 12 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-A1SL3.tmp]- [targetUID: 00000000-00007116] "is-MP6HN.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-MP6HN.tmp]- [targetUID: 00000000-00007116] "is-BDITL.tmp" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-BDITL.tmp]- [targetUID: 00000000-00007116] "is-QLVQ0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-QLVQ0.tmp]- [targetUID: 00000000-00007116] "is-A1MCP.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-A1MCP.tmp]- [targetUID: 00000000-00007116] "is-AQ9IB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-AQ9IB.tmp]- [targetUID: 00000000-00007116] "is-4JQOQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 8 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-4JQOQ.tmp]- [targetUID: 00000000-00007116] "is-BIV86.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-BIV86.tmp]- [targetUID: 00000000-00007116] "is-V7L16.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-V7L16.tmp]- [targetUID: 00000000-00007116] "is-M4VTM.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-M4VTM.tmp]- [targetUID: 00000000-00007116] "is-LCR95.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 15 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LCR95.tmp]- [targetUID: 00000000-00007116] "is-KD5P6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-KD5P6.tmp]- [targetUID: 00000000-00007116] "is-1KKJQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 8 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-1KKJQ.tmp]- [targetUID: 00000000-00007116] "is-9BSBF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-9BSBF.tmp]- [targetUID: 00000000-00007116] "is-46K6A.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-46K6A.tmp]- [targetUID: 00000000-00007116] "is-M495I.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-M495I.tmp]- [targetUID: 00000000-00007116] "is-0493E.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 18 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-0493E.tmp]- [targetUID: 00000000-00007116] "Setup.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\is-NI9S7.tmp\Setup.tmp]- [targetUID: 00000000-00003816] "is-23FR4.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-23FR4.tmp]- [targetUID: 00000000-00007116] "is-7M434.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 7 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-7M434.tmp]- [targetUID: 00000000-00007116] "is-GUR4M.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\7z\is-GUR4M.tmp]- [targetUID: 00000000-00007116] "is-3JSDU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-3JSDU.tmp]- [targetUID: 00000000-00007116] "is-CQCML.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-CQCML.tmp]- [targetUID: 00000000-00007116] "is-R3LHR.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-R3LHR.tmp]- [targetUID: 00000000-00007116] "is-LA5M6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 8 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LA5M6.tmp]- [targetUID: 00000000-00007116] "is-NAEV7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-NAEV7.tmp]- [targetUID: 00000000-00007116] "is-CKQ1E.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-CKQ1E.tmp]- [targetUID: 00000000-00007116] "is-E9FQ3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-E9FQ3.tmp]- [targetUID: 00000000-00007116] "is-N777F.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-N777F.tmp]- [targetUID: 00000000-00007116] "is-OGC2S.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-OGC2S.tmp]- [targetUID: 00000000-00007116] "is-6RRP3.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-6RRP3.tmp]- [targetUID: 00000000-00007116] "is-5IDBB.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-5IDBB.tmp]- [targetUID: 00000000-00007116] "is-V6MCR.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-V6MCR.tmp]- [targetUID: 00000000-00007116] "is-VT143.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 8 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-VT143.tmp]- [targetUID: 00000000-00007116] "is-90P4E.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-90P4E.tmp]- [targetUID: 00000000-00007116] "is-FJUE1.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-FJUE1.tmp]- [targetUID: 00000000-00007116] "is-R26TH.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-R26TH.tmp]- [targetUID: 00000000-00007116] "is-R9L1J.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-R9L1J.tmp]- [targetUID: 00000000-00007116] "is-N72LL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-N72LL.tmp]- [targetUID: 00000000-00007116] "is-33TGT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-33TGT.tmp]- [targetUID: 00000000-00007116] "is-SL0G3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-SL0G3.tmp]- [targetUID: 00000000-00007116] "is-DG55D.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-DG55D.tmp]- [targetUID: 00000000-00007116] "is-53LFN.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-53LFN.tmp]- [targetUID: 00000000-00007116] "is-T8K3O.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-T8K3O.tmp]- [targetUID: 00000000-00007116] "is-JS9KT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-JS9KT.tmp]- [targetUID: 00000000-00007116] "is-CNI1D.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-CNI1D.tmp]- [targetUID: 00000000-00007116] "is-FERRI.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 4 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-FERRI.tmp]- [targetUID: 00000000-00007116] "is-5N14N.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-5N14N.tmp]- [targetUID: 00000000-00007116] "is-F98U6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-F98U6.tmp]- [targetUID: 00000000-00007116] "is-V84VB.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\7z\is-V84VB.tmp]- [targetUID: 00000000-00007116] "is-D7A3P.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-D7A3P.tmp]- [targetUID: 00000000-00007116] "is-366N1.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-366N1.tmp]- [targetUID: 00000000-00007116] "is-VLIDN.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-VLIDN.tmp]- [targetUID: 00000000-00007116] "is-TIL0J.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-TIL0J.tmp]- [targetUID: 00000000-00007116] "is-LKQ00.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LKQ00.tmp]- [targetUID: 00000000-00007116] "is-F4SHH.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-F4SHH.tmp]- [targetUID: 00000000-00007116] "is-2KN6R.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-2KN6R.tmp]- [targetUID: 00000000-00007116] "is-TVOK2.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-TVOK2.tmp]- [targetUID: 00000000-00007116] "is-8EQVV.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-8EQVV.tmp]- [targetUID: 00000000-00007116] "is-VEFR4.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-VEFR4.tmp]- [targetUID: 00000000-00007116] "is-6F73G.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-6F73G.tmp]- [targetUID: 00000000-00007116] "is-KVUP8.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-KVUP8.tmp]- [targetUID: 00000000-00007116] "is-UO7PA.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-UO7PA.tmp]- [targetUID: 00000000-00007116] "is-LCD4T.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LCD4T.tmp]- [targetUID: 00000000-00007116] "is-G2P2S.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-G2P2S.tmp]- [targetUID: 00000000-00007116] "is-6H9K6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-6H9K6.tmp]- [targetUID: 00000000-00007116] "is-F4HC9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-F4HC9.tmp]- [targetUID: 00000000-00007116] "is-G7N9B.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-G7N9B.tmp]- [targetUID: 00000000-00007116] "is-KPKA6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-KPKA6.tmp]- [targetUID: 00000000-00007116] "is-COIK5.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-COIK5.tmp]- [targetUID: 00000000-00007116] "is-MCBQ2.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-MCBQ2.tmp]- [targetUID: 00000000-00007116] "is-E84U0.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-E84U0.tmp]- [targetUID: 00000000-00007116] "is-OP2F6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 6 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-OP2F6.tmp]- [targetUID: 00000000-00007116] "is-C6GCR.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-C6GCR.tmp]- [targetUID: 00000000-00007116] "is-SLHEB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-SLHEB.tmp]- [targetUID: 00000000-00007116] "is-A66A8.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-A66A8.tmp]- [targetUID: 00000000-00007116] "is-VMA3H.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-VMA3H.tmp]- [targetUID: 00000000-00007116] "is-1K1IE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-1K1IE.tmp]- [targetUID: 00000000-00007116] "is-V57CC.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-V57CC.tmp]- [targetUID: 00000000-00007116] "is-BT3OP.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-BT3OP.tmp]- [targetUID: 00000000-00007116] "is-5NIT8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-5NIT8.tmp]- [targetUID: 00000000-00007116] "is-K7GE7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-K7GE7.tmp]- [targetUID: 00000000-00007116] "is-4KKAU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-4KKAU.tmp]- [targetUID: 00000000-00007116] "is-TKVT6.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-TKVT6.tmp]- [targetUID: 00000000-00007116] "is-43FPG.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-43FPG.tmp]- [targetUID: 00000000-00007116] "is-LGJ68.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-LGJ68.tmp]- [targetUID: 00000000-00007116] "is-BNC0M.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-BNC0M.tmp]- [targetUID: 00000000-00007116] "is-BMMLM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-BMMLM.tmp]- [targetUID: 00000000-00007116] "is-F58IK.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-F58IK.tmp]- [targetUID: 00000000-00007116] "is-7CE1K.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- [targetUID: 00000000-00007116] "is-QCQ4N.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-QCQ4N.tmp]- [targetUID: 00000000-00007116] "is-VMR4I.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-VMR4I.tmp]- [targetUID: 00000000-00007116] "is-ALBNT.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-ALBNT.tmp]- [targetUID: 00000000-00007116] "is-G8OSK.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-G8OSK.tmp]- [targetUID: 00000000-00007116] "is-G3UF9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-G3UF9.tmp]- [targetUID: 00000000-00007116] "is-C7R7M.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-C7R7M.tmp]- [targetUID: 00000000-00007116] "is-241L3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-241L3.tmp]- [targetUID: 00000000-00007116] "is-DSQ48.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-DSQ48.tmp]- [targetUID: 00000000-00007116] "is-3SNGI.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-3SNGI.tmp]- [targetUID: 00000000-00007116] "is-J6LDS.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-J6LDS.tmp]- [targetUID: 00000000-00007116] "is-8H1MB.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-8H1MB.tmp]- [targetUID: 00000000-00007116] "is-3PD71.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-3PD71.tmp]- [targetUID: 00000000-00007116] "is-QFAT9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-QFAT9.tmp]- [targetUID: 00000000-00007116] "is-8F6SM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-8F6SM.tmp]- [targetUID: 00000000-00007116] "is-2JLLL.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-2JLLL.tmp]- [targetUID: 00000000-00007116] "is-D0ATO.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-D0ATO.tmp]- [targetUID: 00000000-00007116] "is-HDL5L.tmp" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-HDL5L.tmp]- [targetUID: 00000000-00007116] "is-CE0T2.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-CE0T2.tmp]- [targetUID: 00000000-00007116] "is-KOP83.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-KOP83.tmp]- [targetUID: 00000000-00007116] "is-FRCB9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-FRCB9.tmp]- [targetUID: 00000000-00007116] "is-DK9PE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-DK9PE.tmp]- [targetUID: 00000000-00007116] "is-OD89A.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-OD89A.tmp]- [targetUID: 00000000-00007116] "is-DM0RC.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-DM0RC.tmp]- [targetUID: 00000000-00007116] "is-G37DJ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-G37DJ.tmp]- [targetUID: 00000000-00007116] "is-FUQ38.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-FUQ38.tmp]- [targetUID: 00000000-00007116] "is-1JGMD.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-1JGMD.tmp]- [targetUID: 00000000-00007116] "is-J79DL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-J79DL.tmp]- [targetUID: 00000000-00007116] "is-98V5L.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-98V5L.tmp]- [targetUID: 00000000-00007116] "is-3L6KM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-3L6KM.tmp]- [targetUID: 00000000-00007116] "is-PV8A9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-PV8A9.tmp]- [targetUID: 00000000-00007116] "is-BEHP8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-BEHP8.tmp]- [targetUID: 00000000-00007116] "is-CE65T.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-CE65T.tmp]- [targetUID: 00000000-00007116] "is-2E2TI.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-2E2TI.tmp]- [targetUID: 00000000-00007116] "is-RTIMT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-RTIMT.tmp]- [targetUID: 00000000-00007116] "is-JOQHS.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-JOQHS.tmp]- [targetUID: 00000000-00007116] "is-5BKLK.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-5BKLK.tmp]- [targetUID: 00000000-00007116] "is-MQABO.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-MQABO.tmp]- [targetUID: 00000000-00007116] "is-M2JHU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-M2JHU.tmp]- [targetUID: 00000000-00007116] "is-DD9C5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-DD9C5.tmp]- [targetUID: 00000000-00007116] "is-35AIF.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-35AIF.tmp]- [targetUID: 00000000-00007116] "is-423HL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-423HL.tmp]- [targetUID: 00000000-00007116] "is-AROVF.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-AROVF.tmp]- [targetUID: 00000000-00007116] "is-MT3VE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-MT3VE.tmp]- [targetUID: 00000000-00007116] "is-P8OOU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-P8OOU.tmp]- [targetUID: 00000000-00007116] "is-TF6SH.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-TF6SH.tmp]- [targetUID: 00000000-00007116] "is-N54SL.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-N54SL.tmp]- [targetUID: 00000000-00007116] "is-TMSMO.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-TMSMO.tmp]- [targetUID: 00000000-00007116] "is-G8US8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-G8US8.tmp]- [targetUID: 00000000-00007116] "is-LHMN0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-LHMN0.tmp]- [targetUID: 00000000-00007116] "is-MFOG1.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-MFOG1.tmp]- [targetUID: 00000000-00007116] "is-MMFCS.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-MMFCS.tmp]- [targetUID: 00000000-00007116] "is-GA73U.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-GA73U.tmp]- [targetUID: 00000000-00007116] "is-1UC8K.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-1UC8K.tmp]- [targetUID: 00000000-00007116] "is-52ENU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-52ENU.tmp]- [targetUID: 00000000-00007116] "is-QGNFT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-QGNFT.tmp]- [targetUID: 00000000-00007116] "is-1D9PP.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-1D9PP.tmp]- [targetUID: 00000000-00007116] "is-6PPKU.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-6PPKU.tmp]- [targetUID: 00000000-00007116] "is-0HRPT.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-0HRPT.tmp]- [targetUID: 00000000-00007116] "is-OS152.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-OS152.tmp]- [targetUID: 00000000-00007116] "is-5SL8J.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-5SL8J.tmp]- [targetUID: 00000000-00007116] "is-2IBH9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-2IBH9.tmp]- [targetUID: 00000000-00007116] "is-BH7Q5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-BH7Q5.tmp]- [targetUID: 00000000-00007116] "is-LDP29.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-LDP29.tmp]- [targetUID: 00000000-00007116] "is-K5RO5.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-K5RO5.tmp]- [targetUID: 00000000-00007116] "is-GD1FD.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- [targetUID: 00000000-00007116] "is-F1O5H.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\Monitor\is-F1O5H.tmp]- [targetUID: 00000000-00007116] "is-HT34J.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-HT34J.tmp]- [targetUID: 00000000-00007116] "is-93QS8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-93QS8.tmp]- [targetUID: 00000000-00007116] "is-QSBKD.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-QSBKD.tmp]- [targetUID: 00000000-00007116] "is-NI8US.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-NI8US.tmp]- [targetUID: 00000000-00007116] "is-N7NQJ.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-N7NQJ.tmp]- [targetUID: 00000000-00007116] "is-NB359.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-NB359.tmp]- [targetUID: 00000000-00007116] "is-F7B6S.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-F7B6S.tmp]- [targetUID: 00000000-00007116] "is-6JSE0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-6JSE0.tmp]- [targetUID: 00000000-00007116] "is-SOEA8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-SOEA8.tmp]- [targetUID: 00000000-00007116] "is-EH3PK.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-EH3PK.tmp]- [targetUID: 00000000-00007116] "is-R11SD.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 2 sections"- Location: [C:\inetpub\PassFab iPhone Unlocker\is-R11SD.tmp]- [targetUID: 00000000-00007116] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\is-GO4C5.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00007116]63:Taa7,"Setup.exe" wrote 59280 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-NI9S7.tmp\Setup.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a000000000000000000000000000000000000000000496e556e000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "Setup.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-GO4C5.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Setup.tmp" wrote 16384 bytes starting with PE header signature to file "C:\inetpub\PassFab iPhone Unlocker\is-NB28T.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a000000000000000000000000000000000000000000496e556e000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "Setup.tmp" wrote 34192 bytes starting with PE header signature to file "C:\inetpub\PassFab iPhone Unlocker\is-HDL5L.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Setup.tmp" wrote 51080 bytes starting with PE header signature to file "C:\inetpub\PassFab iPhone Unlocker\is-D0ATO.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Setup.tmp" wrote 55688 bytes starting with PE header signature to file "C:\inetpub\PassFab iPhone Unlocker\is-8F6SM.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Setup.tmp" wrote 58256 bytes starting with PE header signature to file "C:\inetpub\PassFab iPhone Unlocker\is-QFAT9.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...64:T6e2,"Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "108ae" "cx": "16" "cy": "16"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "1010ae9" "cx": "32" "cy": "32"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "10b0a" "cx": "233" "cy": "21"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "3010b13" "cx": "233" "cy": "23"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "108ae" "cx": "233" "cy": "21"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "3010b13" "cx": "75" "cy": "23"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "108ae" "cx": "52" "cy": "39"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "108ae" "cx": "32" "cy": "32"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "3010b13" "cx": "17" "cy": "144"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "10b0a" "cx": "17" "cy": "110"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "1010ae9" "cx": "417" "cy": "17"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "10af6" "cx": "75" "cy": "23"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "3901089f" "cx": "332" "cy": "21"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "1010adc" "cx": "332" "cy": "21"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "108ae" "cx": "328" "cy": "17"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "2010a45" "cx": "332" "cy": "21"} "Setup.tmp" called "CreateCompatibleBitmap" with parameters {"hdc": "1010ac5" "cx": "328" "cy": "17"}65:T8cc,"Setup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\is-NI9S7.tmp\Setup.tmp" with delete access "Setup.tmp" opened "C:\Users\%OSUSER%\Desktop\PassFab iPhone Unlocker.lnk" with delete access "Setup.tmp" opened "C:\Users\Public\Desktop\PassFab iPhone Unlocker.lnk" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-NB28T.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\config\is-47LI0.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-BDITL.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-G3UF9.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-FERRI.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-F98U6.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-HDL5L.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-K7GE7.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-G7N9B.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-KRQ23.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-COIK5.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-D0ATO.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-QLVQ0.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-90P4E.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-4KKAU.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-57J6K.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-UO7PA.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-LKQ00.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-53LFN.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-M495I.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-366N1.tmp" with delete access "Setup.tmp" opened "C:\inetpub\PassFab iPhone Unlocker\is-VMA3H.tmp" with delete access66:T508,"is-A1MCP.tmp" claimed CRC 4255140 while the actual is CRC 76593554 "is-4JQOQ.tmp" claimed CRC 2929274 while the actual is CRC 4255140 "is-BIV86.tmp" claimed CRC 2874814 while the actual is CRC 2929274 "is-V7L16.tmp" claimed CRC 2277355 while the actual is CRC 2874814 "is-M4VTM.tmp" claimed CRC 2170858 while the actual is CRC 2277355 "is-LCR95.tmp" claimed CRC 2067209 while the actual is CRC 2170858 "is-KD5P6.tmp" claimed CRC 1774457 while the actual is CRC 2067209 "is-1KKJQ.tmp" claimed CRC 1789049 while the actual is CRC 1774457 "is-9BSBF.tmp" claimed CRC 1723136 while the actual is CRC 1789049 "is-46K6A.tmp" claimed CRC 1599862 while the actual is CRC 1723136 "is-M495I.tmp" claimed CRC 1506126 while the actual is CRC 1599862 "is-0493E.tmp" claimed CRC 1438643 while the actual is CRC 1506126 "Setup.tmp" claimed CRC 1409358 while the actual is CRC 1438643 "is-23FR4.tmp" claimed CRC 1324540 while the actual is CRC 1409358 "is-7M434.tmp" claimed CRC 1266492 while the actual is CRC 1324540 "is-GUR4M.tmp" claimed CRC 1191677 while the actual is CRC 1266492 "is-3JSDU.tmp" claimed CRC 1196755 while the actual is CRC 1191677 "is-CQCML.tmp" claimed CRC 1112377 while the actual is CRC 1196755 "is-R3LHR.tmp" claimed CRC 1058593 while the actual is CRC 111237767:T6ea,RegOpenKeyExW RegCloseKey OpenProcessToken GetModuleHandleW WriteFile LoadLibraryW GetSystemInfo GetProcAddress VirtualAlloc UnhandledExceptionFilter GetFileSize GetCommandLineW GetStartupInfoA Sleep FindFirstFileW GetSystemDirectoryW FindResourceW CreateProcessW GetFileAttributesW DeleteFileW GetTickCount LoadLibraryExW LockResource GetModuleFileNameW CreateDirectoryW CreateFileW GetVersionExW VirtualProtect RegCreateKeyExW RegEnumKeyW RegEnumKeyExW RegDeleteKeyW RegDeleteValueW GetTempFileNameW GetTempPathW TerminateProcess OutputDebugStringW OutputDebugStringA CreateFileMappingW CreateThread GetModuleHandleExW FindNextFileW MapViewOfFile FindResourceExW GetModuleHandleA FindFirstFileExW GetStartupInfoW ExitThread GetFileAttributesExW GetCommandLineA CreateToolhelp32Snapshot Process32FirstW LoadLibraryA CopyFileW IsDebuggerPresent OpenProcess Process32NextW GetFileSizeEx ShellExecuteW GetCursorPos GetLastActivePopup GetUpdateRect SetWindowsHookExW GetWindowThreadProcessId InternetGetConnectedState GetTempPathA CreateFileA accept GetUserNameW RegOpenKeyExA DeviceIoControl GetModuleFileNameA OpenFileMappingW LoadLibraryExA ConnectNamedPipe SleepEx InternetCloseHandle HttpQueryInfoW InternetOpenW HttpQueryInfoA InternetConnectA InternetOpenA InternetOpenUrlA InternetReadFile HttpSendRequestExA send socket connect closesocket listen bind recv WSAStartup GetUserNameA InternetQueryOptionA RegOpenKeyW recvfrom sendto CreateFileMappingA GetVersionExA DeleteFileA MapViewOfFileEx GetDriveTypeW GetTickCount64 FindWindowA RegCreateKeyW GetComputerNameW GetSystemDirectoryA ShellExecuteExW GetDriveTypeA FindFirstFileA SetSecurityDescriptorDacl68:T408,file/memory contains long string(File: "is-GRHDD.tmp") file/memory contains long string(File: "is-4KCIR.tmp") file/memory contains long string(File: "is-LDS5R.tmp") file/memory contains long string(File: "is-CQ6EQ.tmp") Found string "Setting NTFS compression on directory: %s" (Source: "00000000-00000972.00000001.138643.00401000.00000020.mdmp") Found string "Unsetting NTFS compression on directory: %s" (Source: "00000000-00000972.00000001.138643.00401000.00000020.mdmp") Found string "Failed to set NTFS compression state (%d)." (Source: "00000000-00000972.00000001.138643.00401000.00000020.mdmp") Found string "Setting NTFS compression on file: %s" (Source: "00000000-00000972.00000001.138643.00401000.00000020.mdmp") Found string "Unsetting NTFS compression on file: %s" (Source: "00000000-00000972.00000001.138643.00401000.00000020.mdmp") Found string "Defines values for the compression modes used to save the Ink object to a serialized format.WW" (Source: "00000000-00000972.00000001.138643.7242D000.00000002.mdmp")69:T630,"Setup.tmp" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1") "Setup.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1") "Setup.tmp" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1") "Setup.tmp" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1") "Setup.tmp" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\") "Setup.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP") "Setup.tmp" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2") "Setup.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2") "Setup.tmp" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2") "Setup.tmp" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2") "Setup.tmp" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3") "Setup.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3") "Setup.tmp" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3")6a:Ta17,"Setup.exe" queried SystemProcessInformation at 00000000-00004648-00000C15-1098058507 [PID: 4648] "Setup.exe" queried SystemProcessInformation at 00000000-00004648-00000C15-1098066846 [PID: 4648] "Setup.tmp" queried SystemProcessInformation at 00000000-00000972-00000C15-1099088877 [PID: 972] "Setup.tmp" queried SystemProcessInformation at 00000000-00000972-00000C15-1099095800 [PID: 972] "Setup.tmp" queried SystemProcessInformation at 00000000-00000972-00000C15-1105785680 [PID: 972] "Setup.tmp" queried SystemProcessInformation at 00000000-00000972-00000C15-1105792194 [PID: 972] "Setup.tmp" queried SystemProcessInformation at 00000000-00000972-00000C15-1107877034 [PID: 972] "Setup.tmp" queried SystemProcessInformation at 00000000-00000972-00000C15-1107883673 [PID: 972] "Setup.tmp" queried SystemProcessInformation at 00000000-00000972-00000C15-1129535954 [PID: 972] "Setup.tmp" queried SystemProcessInformation at 00000000-00000972-00000C15-1129543013 [PID: 972] "cmd.exe" queried SystemProcessInformation at 00000000-00008056-00000C15-1107184900 [PID: 8056] "cmd.exe" queried SystemProcessInformation at 00000000-00008056-00000C15-1107192150 [PID: 8056] "cmd.exe" queried SystemProcessInformation at 00000000-00008056-00000C15-1107478527 [PID: 8056] "cmd.exe" queried SystemProcessInformation at 00000000-00008056-00000C15-1107485470 [PID: 8056] "Start.exe" queried SystemProcessInformation at 00000000-00001368-00000C15-1147564314 [PID: 1368] "Start.exe" queried SystemProcessInformation at 00000000-00001368-00000C15-1147570900 [PID: 1368] "Start.exe" queried SystemProcessInformation at 00000000-00001368-00000C15-1151261407 [PID: 1368] "Start.exe" queried SystemProcessInformation at 00000000-00001368-00000C15-1151270341 [PID: 1368] "PassFab iPhone Unlocker.exe" queried SystemProcessInformation at 00000000-00008076-00000C15-1152087062 [PID: 8076] "PassFab iPhone Unlocker.exe" queried SystemProcessInformation at 00000000-00008076-00000C15-1152093788 [PID: 8076] "PassFab iPhone Unlocker.exe" queried SystemProcessInformation at 00000000-00008076-00000C15-1152469854 [PID: 8076] "PassFab iPhone Unlocker.exe" queried SystemProcessInformation at 00000000-00008076-00000C15-1152476682 [PID: 8076] "PassFab iPhone Unlocker.exe" queried SystemProcessInformation at 00000000-00008076-00000C15-1153921305 [PID: 8076] "PassFab iPhone Unlocker.exe" queried SystemProcessInformation at 00000000-00008076-00000C15-1153929203 [PID: 8076] "PassFab iPhone Unlocker.exe" queried SystemProcessInformation at 00000000-00008076-00000C15-1157106630 [PID: 8076]6b:Ta88,Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "Setup.exe") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "Setup.exe") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; File: "Setup.exe") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "Setup.exe") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "Setup.exe") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; File: "Setup.exe") Found api reference "CryptHashData" (Indicator: "CryptHashData"; File: "Setup.exe") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "Setup.exe") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "Setup.exe") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; File: "Setup.exe") Found api reference "CertSetStoreProperty" (Indicator: "CertSetStoreProperty"; File: "Setup.exe") Found api reference "CertAddEncodedCertificateToStore" (Indicator: "CertAddEncodedCertificateToStore"; File: "Setup.exe") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "Setup.exe") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "Setup.exe") Found api reference "CertDuplicateCertificateChain" (Indicator: "CertDuplicateCertificateChain"; File: "Setup.exe") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "Setup.exe") Found api reference "CertGetStoreProperty" (Indicator: "CertGetStoreProperty"; File: "Setup.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "Setup.exe") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChain"; File: "Setup.exe") Found api reference "CertFreeCertificateChainEngine" (Indicator: "CertFreeCertificateChainEngine"; File: "Setup.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "Setup.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "Setup.exe") Found api reference "CertCreateCertificateChainEngine" (Indicator: "CertCreateCertificateChainEngine"; File: "Setup.exe") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; File: "Setup.exe") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "Setup.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "Setup.exe")6c:T509,GetTickCount@KERNEL32.DLL at 00000000-00004648-49883-486-004030BC GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-131-004DEAEC GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-1017-00480EBC GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-1019-00480EA4 GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-1125-004B3678 GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-3333-00445060 GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-3370-00448F68 GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-3701-004655D8 GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-3856-0046A734 GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-3911-004715B8 GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-4743-004D85EC GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-4803-004E6308 GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-4893-004032D4 GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-5140-004FCA0C GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-6978-004DEA98 GetTickCount@KERNEL32.DLL at 00000000-00000972-52444-7150-004FB9FC GetTickCount@KERNEL32.DLL at 00000000-00001368-57943-3888-01044353 GetTickCount@KERNEL32.DLL at 00000000-00001368-57943-5621-010B2C8C GetTickCount@KERNEL32.DLL at 00000000-00001368-57943-11016-010BF0776d:T49a,FindFirstFileW@KERNEL32.DLL at 00000000-00004648-49883-37-00405BEC FindFirstFileW@KERNEL32.DLL at 00000000-00000972-52444-37-00408174 FindNextFileW@KERNEL32.DLL at 00000000-00000972-52444-175-004AEA0C FindFirstFileW@KERNEL32.DLL at 00000000-00000972-52444-187-004AD294 FindNextFileW@KERNEL32.DLL at 00000000-00000972-52444-961-004E2074 FindNextFileW@KERNEL32.DLL at 00000000-00000972-52444-1095-004D1578 FindNextFileW@KERNEL32.DLL at 00000000-00000972-52444-4443-004AECF0 FindFirstFileW@KERNEL32.DLL at 00000000-00000972-52444-4600-004BF43C FindFirstFileW@KERNEL32.DLL at 00000000-00000972-52444-4626-004C0BC0 FindFirstFileW@KERNEL32.DLL at 00000000-00000972-52444-4634-004C107C FindNextFileW@KERNEL32.DLL at 00000000-00000972-52444-4711-004DF4CC FindFirstFileW@KERNEL32.DLL at 00000000-00000972-52444-4782-004D4F34 FindFirstFileW@KERNEL32.DLL at 00000000-00000972-52444-5145-004FDF38 FindFirstFileW@KERNEL32.DLL at 00000000-00000972-52444-8082-004012D2 FindNextFileW@KERNEL32.DLL at 00000000-00000972-52444-10077-004F71E2 FindFirstFileW@KERNEL32.DLL at 00000000-00001368-57943-1871-00FE2B57 FindFirstFileExW@KERNEL32.DLL at 00000000-00001368-57943-7009-0112FC3B6e:T679,GetVersionExW@KERNEL32.DLL at 00000000-00004648-49883-77-0040A358 GetVersion@KERNEL32.DLL at 00000000-00004648-49883-85-00411000 GetVersion@KERNEL32.DLL at 00000000-00004648-49883-86-0040646C GetVersion@KERNEL32.DLL at 00000000-00004648-49883-370-004110C4 GetVersionExW@KERNEL32.DLL at 00000000-00000972-52444-77-004124AC GetVersion@KERNEL32.DLL at 00000000-00000972-52444-85-00500000 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-86-00408DE4 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-919-004CC238 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-1118-004B8A78 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-3418-0044DDFC GetVersion@KERNEL32.DLL at 00000000-00000972-52444-4089-0047F814 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-4094-0047FFEC GetVersionExW@KERNEL32.DLL at 00000000-00000972-52444-4316-004A4E40 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-4409-004AA464 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-4605-004BFA6C GetVersion@KERNEL32.DLL at 00000000-00000972-52444-4607-004BFBD4 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-5152-005000C4 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-5163-00500B48 GetVersionExW@KERNEL32.DLL at 00000000-00000972-52444-5175-004E6DD4 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-6819-004BFB28 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-6820-004BF928 GetVersion@KERNEL32.DLL at 00000000-00000972-52444-10019-004A8D84 GetVersionExW@KERNEL32.DLL at 00000000-00000972-52444-10087-00500D2B GetVersionExW@KERNEL32.DLL at 00000000-00001368-57943-7078-00FDDD99 GetVersionExW@KERNEL32.DLL at 00000000-00001368-57943-7532-010443A86f:T4d2,GetKeyboardType@USER32.DLL at 00000000-00004648-49883-90-004036E4 GetUserDefaultLangID@KERNEL32.DLL at 00000000-00004648-49883-359-0040E66C GetKeyboardType@USER32.DLL at 00000000-00004648-49883-406-004035B3 GetKeyboardType@USER32.DLL at 00000000-00000972-52444-90-00403E38 GetKeyboardLayoutList@USER32.DLL at 00000000-00000972-52444-373-004799B4 GetKeyboardLayoutNameW@USER32.DLL at 00000000-00000972-52444-3471-004526E0 GetKeyboardLayout@USER32.DLL at 00000000-00000972-52444-3478-004528E8 GetKeyboardLayout@USER32.DLL at 00000000-00000972-52444-3822-004793CC GetUserDefaultLangID@KERNEL32.DLL at 00000000-00000972-52444-4469-004B0DD8 GetKeyboardType@USER32.DLL at 00000000-00000972-52444-5219-00403D07 GetTextCharsetInfo@GDI32.DLL at 00000000-00001368-57943-436-0100E9F1 GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00001368-57943-668-00FCE0A0 GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00001368-57943-1734-00FE7FA4 GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00001368-57943-1998-00FFA30E GetKeyboardLayout@USER32.DLL at 00000000-00001368-57943-3497-0105DCB8 GetKeyboardLayout@USER32.DLL at 00000000-00001368-57943-3502-0105DA72 GetKeyboardLayout@USER32.DLL at 00000000-00001368-57943-4213-0105D6D870:Tbbc,Found API call GetVersion@KERNEL32.DLL directly followed by "cmp edx, 05h" and "jne 0040648Bh" at 00000000-00004648-49883-86-0040646C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000600h" and "je 0041112Bh" at 00000000-00004648-49883-370-004110C4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp edx, 05h" and "jne 00408E03h" at 00000000-00000972-52444-86-00408DE4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 004CC2A7h" at 00000000-00000972-52444-919-004CC238 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 004B8AAFh" at 00000000-00000972-52444-1118-004B8A78 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 04h" and "jc 0044E01Ch" at 00000000-00000972-52444-3418-0044DDFC Found API call GetKeyboardLayout@USER32.DLL directly followed by "cmp ebx, dword ptr [00503A9Ch]" and "je 00452916h" at 00000000-00000972-52444-3478-004528E8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 0047F86Fh" at 00000000-00000972-52444-4089-0047F814 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 0048006Bh" at 00000000-00000972-52444-4094-0047FFEC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004AA55Bh" at 00000000-00000972-52444-4409-004AA464 Found API call GetDiskFreeSpaceW@KERNEL32.DLL directly followed by "cmp byte ptr [ebp-02h], 00h" and "je 004B0B89h" at 00000000-00000972-52444-4464-004B0A78 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jnc 004BFADFh" at 00000000-00000972-52444-4605-004BFA6C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004BFC4Fh" at 00000000-00000972-52444-4607-004BFBD4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000600h" and "je 0050012Bh" at 00000000-00000972-52444-5152-005000C4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 04h" and "setnb byte ptr [0050B0E4h]" at 00000000-00000972-52444-5163-00500B48 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004BFBA3h" at 00000000-00000972-52444-6819-004BFB28 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp dx, 0005h" and "jne 004BF9AFh" at 00000000-00000972-52444-6820-004BF928 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jne 004A8E30h" at 00000000-00000972-52444-10019-004A8D84 Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by "cmp eax, FFFFFFFFh" and "je 0112B4F1h" at 00000000-00001368-57943-751-0112B3C5 Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-00000120h], 06h" and "jne 00FDDEC6h" at 00000000-00001368-57943-7078-00FDDD99 Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-00000120h], 06h" and "jc 01044454h" at 00000000-00001368-57943-7532-010443A871:T4be,file/memory contains long string(File: "is-GRHDD.tmp") file/memory contains long string(File: "is-I49D5.tmp") file/memory contains long string(File: "is-2G31L.tmp") file/memory contains long string(File: "is-RI7V2.tmp") file/memory contains long string(File: "is-H7IDC.tmp") file/memory contains long string(File: "is-0VECD.tmp") file/memory contains long string(File: "is-MALJR.tmp") file/memory contains long string(File: "is-T03H9.tmp") file/memory contains long string(File: "is-QLLVR.tmp") file/memory contains long string(File: "is-4I69L.tmp") file/memory contains long string(File: "is-O0FTH.tmp") file/memory contains long string(File: "is-9SUKU.tmp") file/memory contains long string(File: "is-57V0E.tmp") file/memory contains long string(File: "is-J40LT.tmp") file/memory contains long string(File: "_setup64.tmp") Found string "GetCommandLineW" (Source: "00000000-00000972.00000000.136725.0050A000.00000004.mdmp, 00000000-00000972.00000000.136725.00512000.00000002.mdmp, 00000000-00000972.00000001.138643.0050A000.00000004.mdmp, 00000000-00000972.00000002.139593.0050A000.00000004.mdmp") Found string "GetCommandLineW" (Source: "00000000-00001368.00000000.139821.01145000.00000002.mdmp")72:T113c,"Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-IDG22.tmp & C:\inetpub\PassFab iPhone Unlocker\unins000.exe (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\config\is-BUL1G.tmp & C:\inetpub\PassFab iPhone Unlocker\config\log.config (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-S0D3T.tmp & C:\inetpub\PassFab iPhone Unlocker\PassFab iPhone Unlocker.exe (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-MI9A9.tmp & C:\inetpub\PassFab iPhone Unlocker\AppService.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-GRHDD.tmp & C:\inetpub\PassFab iPhone Unlocker\BsSndRpt.exe (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-I49D5.tmp & C:\inetpub\PassFab iPhone Unlocker\BugSplat.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-HCMT6.tmp & C:\inetpub\PassFab iPhone Unlocker\BugSplatDotNet.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-4VE3M.tmp & C:\inetpub\PassFab iPhone Unlocker\BugSplatRc.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-96CJA.tmp & C:\inetpub\PassFab iPhone Unlocker\TSMonitorCLR.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-NF1DM.tmp & C:\inetpub\PassFab iPhone Unlocker\deviceModules.json (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-9BVEU.tmp & C:\inetpub\PassFab iPhone Unlocker\DllWrapper.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-UQB7A.tmp & C:\inetpub\PassFab iPhone Unlocker\Downloader.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-1GPSH.tmp & C:\inetpub\PassFab iPhone Unlocker\EntityFramework.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-7DEES.tmp & C:\inetpub\PassFab iPhone Unlocker\EntityFramework.SqlServer.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-MALJR.tmp & C:\inetpub\PassFab iPhone Unlocker\FileReport.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-LK2QV.tmp & C:\inetpub\PassFab iPhone Unlocker\Fukey.exe.config (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-LDS5R.tmp & C:\inetpub\PassFab iPhone Unlocker\ICSharpCode.SharpZipLib.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-NJN0F.tmp & C:\inetpub\PassFab iPhone Unlocker\IosManager.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-MLHQO.tmp & C:\inetpub\PassFab iPhone Unlocker\iTunesEnvFitCLR.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-KJ78D.tmp & C:\inetpub\PassFab iPhone Unlocker\libcurl.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-L0700.tmp & C:\inetpub\PassFab iPhone Unlocker\log4net.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-8NKM6.tmp & C:\inetpub\PassFab iPhone Unlocker\Microsoft.Expression.Drawing.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-N5C6B.tmp & C:\inetpub\PassFab iPhone Unlocker\Microsoft.Windows.Shell.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-2E8TB.tmp & C:\inetpub\PassFab iPhone Unlocker\Newtonsoft.Json.dll (UID: 00000000-00000972) "Setup.tmp" called "MoveFileW" with parameter C:\inetpub\PassFab iPhone Unlocker\is-RU4FN.tmp & C:\inetpub\PassFab iPhone Unlocker\PresentationFramework.Aero2.dll (UID: 00000000-00000972)73:T63c,Sleep@KERNEL32.DLL at 00000000-00004648-49883-224-004024EC Sleep@KERNEL32.DLL at 00000000-00004648-49883-357-0040E5DC MsgWaitForMultipleObjects at 00000000-00004648-49883-366-0040EB50 Sleep@KERNEL32.DLL at 00000000-00004648-49883-392-00401677 Sleep@KERNEL32.DLL at 00000000-00004648-49883-397-00401C7C Sleep@KERNEL32.DLL at 00000000-00004648-49883-401-004018F8 Sleep@KERNEL32.DLL at 00000000-00004648-49883-684-00401E74 Sleep@KERNEL32.DLL at 00000000-00004648-49883-697-0040ABCC WaitForSingleObject@KERNEL32.DLL at 00000000-00000972-52444-196-004B3C38 WaitForSingleObject@KERNEL32.DLL at 00000000-00000972-52444-983-0047A614 SetTimer at 00000000-00000972-52444-985-0047D370 Sleep@KERNEL32.DLL at 00000000-00000972-52444-1015-00480E88 MsgWaitForMultipleObjects at 00000000-00000972-52444-1122-004B3EE8 Sleep@KERNEL32.DLL at 00000000-00000972-52444-2651-0040B964 WaitForSingleObject@KERNEL32.DLL at 00000000-00000972-52444-2652-00413978 Sleep@KERNEL32.DLL at 00000000-00000972-52444-2717-00402700 WaitForSingleObject@KERNEL32.DLL at 00000000-00000972-52444-3088-0042A324 WaitForSingleObject@KERNEL32.DLL at 00000000-00000972-52444-3097-0042A928 MsgWaitForMultipleObjectsEx at 00000000-00000972-52444-3262-00437C48 WaitForSingleObject@KERNEL32.DLL at 00000000-00000972-52444-3277-00438250 SetTimer at 00000000-00000972-52444-3387-0044AAAC MsgWaitForMultipleObjects at 00000000-00000972-52444-3851-0042AB6C Sleep@KERNEL32.DLL at 00000000-00000972-52444-3856-0046A734 Sleep@KERNEL32.DLL at 00000000-00000972-52444-3911-004715B8 SetTimer at 00000000-00000972-52444-4004-0047CF7474:T65f,LoadLibraryExW@KERNEL32.DLL at 00000000-00004648-49883-36-00405DE8 LoadLibraryW@KERNEL32.DLL at 00000000-00004648-49883-244-004069C8 LoadLibraryW@KERNEL32.DLL at 00000000-00004648-49883-263-0040AC84 LoadLibraryExW@KERNEL32.DLL at 00000000-00000972-52444-36-00408370 LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-476-00413C38 LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-1408-004A9DA3 LoadLibraryExW@KERNEL32.DLL at 00000000-00000972-52444-1502-004A1A3C LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-1750-004395AC LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-2759-0040A348 LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-3283-00438998 LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-3811-00469138 LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-3947-004394E8 LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-4318-004A4EC4 LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-4319-004A64B4 LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-4409-004AA464 LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-5170-005010F8 LoadLibraryW@KERNEL32.DLL at 00000000-00000972-52444-7341-00409732 LoadLibraryExW@KERNEL32.DLL at 00000000-00001368-57943-33-0112A451 LoadLibraryExW@KERNEL32.DLL at 00000000-00001368-57943-139-011181F2 LoadLibraryW@KERNEL32.DLL at 00000000-00001368-57943-572-00FDACE3 LoadLibraryW@KERNEL32.DLL at 00000000-00001368-57943-1502-00FDAA5E LoadLibraryExW@KERNEL32.DLL at 00000000-00001368-57943-1505-00FDA9B1 LoadLibraryW@KERNEL32.DLL at 00000000-00001368-57943-1662-00FDABD2 LoadLibraryA@KERNEL32.DLL at 00000000-00001368-57943-1663-00FDABDC75:Ta42,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000972.00000001.138643.00610000.00000004.mdmp 00000000-00000972.00000002.139593.00637000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000972.00000001.138643.00610000.00000004.mdmp 00000000-00000972.00000002.139593.00637000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00000972.00000001.138643.00610000.00000004.mdmp 00000000-00000972.00000002.139593.00637000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00000972.00000001.138643.00610000.00000004.mdmp 00000000-00000972.00000002.139593.00637000.00000004.mdmp 00000000-00000972.00000002.139593.006CD000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp "ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "programdata%\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "%userprofile%\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp76:Tde8,Antivirus vendors marked dropped file "Uninstall PassFab iPhone Unlocker.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID q5djrmuqvpoazm9 Archive ctime=Wed Feb 25 10:09:13 2026 atime=Wed Feb 25 10:09:13 2026 mtime=Wed Feb 25 10:08:42 2026 length=1370000 window=normal IDListSize 0x0163 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\inetpub\PassFab iPhone Unlocker\unins000.exe"") Antivirus vendors marked dropped file "PassFab iPhone Unlocker.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID q5djrmuqvpoazm9 Archive ctime=Wed Feb 25 10:09:19 2026 atime=Wed Feb 25 10:09:19 2026 mtime=Tue Jul 20 18:04:24 2021 length=4231608 window=normal IDListSize 0x0159 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\inetpub\PassFab iPhone Unlocker\Start.exe"") Antivirus vendors marked dropped file "PassFab iPhone Unlocker.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID q5djrmuqvpoazm9 Archive ctime=Wed Feb 25 10:09:19 2026 atime=Wed Feb 25 10:09:28 2026 mtime=Tue Jul 20 18:04:24 2021 length=4231608 window=normal IDListSize 0x0159 Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D" Volume "C:\" LocalBasePath "C:\inetpub\PassFab iPhone Unlocker\Start.exe"") Antivirus vendors marked dropped file "is-6LBMH.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 2 sections"), Antivirus vendors marked dropped file "is-B4196.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 12 sections"), Antivirus vendors marked dropped file "is-1GPSH.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 Mono/.Net assembly 3 sections"), Antivirus vendors marked dropped file "is-JIOV2.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"), Antivirus vendors marked dropped file "is-7B9LV.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"), Antivirus vendors marked dropped file "is-5UBTL.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "is-LSM3Q.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "is-Q3E8M.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"), Antivirus vendors marked dropped file "is-JGH13.tmp" as clean (type is "PE32 executable for MS Windows 5.00 (DLL) Intel i386 15 sections"), Antivirus vendors marked dropped file "is-MMS6B.tmp" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) 10 sections"), Antivirus vendors marked dropped file "is-54I9G.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 8 sections"), Antivirus vendors marked dropped file "is-FQFLT.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "is-RRV4K.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "is-KJ78D.tmp" as clean (type is "PE32 executable for MS Windows 5.00 (DLL) Intel i386 5 sections")77:T28fc,"Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00000972.00000000.136725.00512000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000972.00000000.136725.00512000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00000972.00000000.136725.00512000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00000972.00000000.136725.00512000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000972.00000000.136725.00610000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" in Source: 00000000-00000972.00000000.136725.02750000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" in Source: 00000000-00000972.00000000.136725.02750000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" in Source: 00000000-00000972.00000000.136725.02750000.00000004.mdmp "Software\Borland\Locales" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00000972.00000001.138643.00401000.00000020.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00000972.00000001.138643.00610000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00000972.00000001.138643.00610000.00000004.mdmp "e\SOFTWARE\Mic" in Source: 00000000-00000972.00000001.138643.00610000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000972.00000001.138643.00610000.00000004.mdmp "chine\Software\Classes\CLSID\{2B46E70F-CDA7-473E-89F6-DC9630A2390B}\Instance" in Source: 00000000-00000972.00000001.138643.00610000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}" in Source: 00000000-00000972.00000001.138643.00610000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" in Source: 00000000-00000972.00000001.138643.02750000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" in Source: 00000000-00000972.00000001.138643.02750000.00000004.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" in Source: 00000000-00000972.00000001.138643.030C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" in Source: 00000000-00000972.00000001.138643.030C0000.00000004.mdmp "Software\Microsoft\Input" in Source: 00000000-00000972.00000001.138643.723D1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00000972.00000001.138643.723D1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00000972.00000001.138643.723D1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00000972.00000001.138643.723D1000.00000020.mdmp "YSTEM\Software\Microsoft\" in Source: 00000000-00000972.00000002.139593.0018A000.00000004.mdmp "e\SOFTWARE\Mic" in Source: 00000000-00000972.00000002.139593.00637000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000972.00000002.139593.00637000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs%" in Source: 00000000-00000972.00000002.139593.006CD000.00000004.mdmp "chine\Software\Classes\CLSID\{2B46E70F-CDA7-473E-89F6-DC9630A2390B}\Instance" in Source: 00000000-00000972.00000002.139593.006CD000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{00021401-0000-0000-C000-000000000046}" in Source: 00000000-00000972.00000002.139593.006CD000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}" in Source: 00000000-00000972.00000002.139593.006CD000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\{00021401-0000-0000-C000-000000000046}" in Source: 00000000-00000972.00000002.139593.006CD000.00000004.mdmp "REGISTRY\USER\S-1-5-21-1271187874-1938232448-3812392235-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates\ManifestedMergeStubSdbs9" in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp "istry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp "e\Software\Cla" in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp "istry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\SdbUpdates" in Source: 00000000-00001368.00000000.139821.00830000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00001368.00000000.139821.01145000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00001368.00000000.139821.01145000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00001368.00000000.139821.01145000.00000002.mdmp "Software\" in Source: 00000000-00001368.00000000.139821.01145000.00000002.mdmp "Software\Classes\" in Source: 00000000-00001368.00000000.139821.01145000.00000002.mdmp "SOFTWARE\" in Source: 00000000-00001368.00000000.139821.01145000.00000002.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client" in Source: 00000000-00001368.00000000.139821.01145000.00000002.mdmp "Software\Borland\Locales" in Source: 00000000-00004648.00000000.136631.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00004648.00000000.136631.00401000.00000020.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" in Source: 00000000-00004648.00000000.136631.025E0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{PassFab iPhone Unlocker}_is1" in Source: 00000000-00004648.00000000.136631.025E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008076.00000000.140096.033E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008076.00000000.140096.033E0000.00000004.mdmp "Read6HKEY_CURRENT_USER\Software\Microsoft\Avalon.Packaging\T" in Source: 00000000-00008076.00000000.140096.0A300000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008076.00000001.140912.03485000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008076.00000001.140912.03485000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008076.00000001.140912.03485000.00000004.mdmp "Read6HKEY_CURRENT_USER\Software\Microsoft\Avalon.Packaging\T" in Source: 00000000-00008076.00000001.140912.0A300000.00000004.mdmp "SOFTWARE\Apple Inc.\Apple Mobile Device Support" in Source: 00000000-00008076.00000001.140912.6C7D7000.00000002.mdmp "SOFTWARE\Apple Computer, Inc.\iTunes" in Source: 00000000-00008076.00000001.140912.6C7D7000.00000002.mdmp "SOFTWARE\Apple Inc." in Source: 00000000-00008076.00000001.140912.6C9AE000.00000002.mdmp "SOFTWARE\Wow6432Node\Apple Inc.\CoreFP" in Source: 00000000-00008076.00000001.140912.6C9AE000.00000002.mdmp "SOFTWARE\Apple Inc.\CoreFP" in Source: 00000000-00008076.00000001.140912.6C9AE000.00000002.mdmp "SOFTWARE\Apple Inc.\Apple Mobile Device Support" in Source: 00000000-00008076.00000001.140912.6C9AE000.00000002.mdmp78:T8bd,Found registry deletion API: "RegDeleteKeyExW" in file "00000000-00000972.00000001.138643.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" in file "00000000-00000972.00000001.138643.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" in file "00000000-00000972.00000001.138643.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in file "00000000-00000972.00000001.138643.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW" in file "Setup.exe" Found registry deletion API: "RegDeleteKeyW" in file "Setup.exe" Found registry deletion API: "RegDeleteKeyTransactedW" in file "00000000-00001368.00000000.139821.00FC1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00000972.00000001.138643.00401000.00000020.mdmp, 00000000-00000972.00000001.138643.723D1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExA" in "00000000-00000972.00000001.138643.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00000972.00000001.138643.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00000972.00000001.138643.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in "00000000-00000972.00000001.138643.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00000972.00000001.138643.723D1000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00000972.00000001.138643.7242D000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyTransactedW" in "00000000-00001368.00000000.139821.01145000.00000002.mdmp" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00001368.00000000.139821.01145000.00000002.mdmp"79:T4a2a,"Setup.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "OWNER"; Value: "CC030000F1BA26B83EA6DC0100") "Setup.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "1D2FBC2B74ED54BF348426B577D40E297E93EE6516AD4800914687518A198FFC00") "Setup.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "0100000000") "Setup.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "Setup.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "Setup.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "Setup.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\CMD.EXE"; Value: "89D407BD3EA6DC010000000000000000000000000200000000") "Setup.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "�MN") "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "INNO SETUP: SETUP VERSION"; Value: "5.5.9 (u)"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "INNO SETUP: APP PATH"; Value: "C:\inetpub\PassFab iPhone Unlocker"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "INSTALLLOCATION"; Value: "C:\inetpub\PassFab iPhone Unlocker\"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "INNO SETUP: ICON GROUP"; Value: "PassFab iPhone Unlocker"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "INNO SETUP: USER"; Value: "eihLYmr"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "INNO SETUP: LANGUAGE"; Value: "65006E00000000"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "DISPLAYNAME"; Value: "PassFab iPhone Unlocker 3.0.6.14"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "DISPLAYICON"; Value: "C:\inetpub\PassFab iPhone Unlocker\logo.ico"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "UNINSTALLSTRING"; Value: ""C:\inetpub\PassFab iPhone Unlocker\unins000.exe""), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "QUIETUNINSTALLSTRING"; Value: ""C:\inetpub\PassFab iPhone Unlocker\unins000.exe" /SILENT"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "DISPLAYVERSION"; Value: "3.0.6.14"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "PUBLISHER"; Value: "PassFab Inc."), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "URLINFOABOUT"; Value: "https://www.passfab.com/"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "HELPLINK"; Value: "https://www.passfab.com/"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "URLUPDATEINFO"; Value: "https://www.passfab.com/"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "NOMODIFY"; Value: "0100000000"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "NOREPAIR"; Value: "0100000000"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "INSTALLDATE"; Value: "20260225"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "MAJORVERSION"; Value: "0300000000"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "MINORVERSION"; Value: "0000000000"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "VERSIONMAJOR"; Value: "0300000000"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "VERSIONMINOR"; Value: "0000000000"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{PASSFAB IPHONE UNLOCKER}_IS1"; Key: "ESTIMATEDSIZE"; Value: "4B8F020000"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "2106000000000000040004000102060000000000010000001C390B01010000002FD60F02010000006B507E0018000000795344025E000000A19F5E0001000000F062570204000100000054000000276B69012F00000056737D00090000006B507E0009000000E6C5310002000400000001000000C49B7B0201000000EFBA8302020065000000CE0C0000E6C5310004000000F0E0B60000"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "DE14000000000000040004000100040202000000003ADE0000B31C0200F76A010152B601020909020212F80002388F020285C70102E8C20103A63A0203CBE40103F91B02043E8E02045F9A0204931A0104AF630104DADC0105DE850205F9E70106C42802079A1902088D4201089E1902095E2F0209A336010A6B6C010BE8C5010BF99C020C3131020CE9C2000D28C7010D7879000D7E3E020D7E4F020DD3F9000E091A020E303E020E9F67020F168C01101755021043E800112969021142C20011AB3D0212E5F800130A360213951B0213E9780014FD160215E07E0216D134021793380117C06F0117DE370118208A02186C1E0219C0E2001A2D42021AE8EC011BF60B001C8FCF001C955C001D3083021D3BC5011D5819021E451E021EC330021ED770011F34CC011F626C022018F200213AC301223BED0122A7730123116E01237AF80123CC4F01246B460124ACC70024C18B0125023802254F6E01262B9401264BA801267F9D022834190228A11B012919DA0129450101297DA90129861F0229CE33022AC7DE002B2499002BD8E5012C9F7A022CA603022D22DA012D5838012E1EF0012E4A1C022E6974012E7714022F4CE5012FA8FF0131484F003257A400329F7A0232D1A70032D45F0133FB2A0233FE38023542CC0135602102361EE10139A7C20139AFDE013A99D9013B8031023CB352003D121F023D218F023DC47F023E1CB7013E5BED01403D670140A28E0141A8760041BC3A02420D510242264A0042B3AE0042C54D0243AB210144A4C401454ED30045668A024677300146AB2E02483BDB0148C24F0048F9A60049CBA30149DA1B0249EAB7004AAA81004AC433024ADEE1014B2A91014B6EE3014B7207024BF474024C15AA014C41B4004CC84B014D3ED9014E50C2014F14C2004FA53302508F000252769302534673015355E401536A3A025408340254302F0254B7DC0054DFE20155DB8C0155E6E10157426B01577AF801578A1B0257AD120158021202589E270258BB5C02594F87025953940059C43C025A0189025A0289025A0A83025AE213025AF783025B1203025C3598015E83D7015EF05F025F83500261D42A0261D98C0162DC300262EF34026396770063FD310264054E0264C9260164D4190164F42B0265C4850265ED1D0267ABEE0167BA6B0268130102682C90006957EA0169592A0269CC4F016A3683026A61E8016A7365016A95E2016BF42B026C0B76026C137F026C6F66026CA164026D2390026DEE2C026E4538027052E20170A32C0271014902718C9A02726E4A0072A2420172CD990173422F0274A3A30175A37E007691CF0177D52F0277F98F01785DD30179DE980279F99C027A5B7C027C82C9017CBAFC017DBBD6017E1044017E3732027E5030027EEE89027F16AA017F88CA008001840281B0690281B942028227730082409702825B8A0282FB2A02833AC50183F16000844D260184D7780284E11E0284E6830085311B028550AE0085E34102861BDE0186ECB6018754990287D5140287F0250187FC38028881870288D13302890CE901892F830289DC8B018A8093008AFAE3008BEEF2008BFD6E018C1D88028C8F94028E78A2008E90C6018ED891018FEAF9019123D30091C335029259160092603302928271009369C70093CA3D0293CE8C019439F701945AE001945B270294A15B0195126E01959F33019697E30196A26E0198C7F10198D7780299429B02996776029A0B73019B4A72029C429B029C4D22029CE0A8009D9D92009E1E90019F8230029F8314029FF47702A1236602A19D2A01A2050600A2065D02A2961002A3998D02A3C4E200A3C88302A4580200A4778D02A4AEE901A5092E02A5ADCF00A644A600A6749502A7B8AD00A7C23301A7E23E02A8EA4E02AAB1FC01AAF63F02AB9FC901ABF42B02AC4D1C02AC54F900AC930202AD2DB801AD73BF00AE4D5702AEE69101AF086501AF9C0202B09E9702B0F13802B2376E01B2827902B2BAFC01B3732002B3742D02B392FB00B4D7C501B51B6701B5661202B7750C02B7E23E02B7F15002B8C37F02B91AF300B9B92A02B9FA7702BB51DD01BB8E1602BB8E8B00BBF42B02BD388F00BEAF8A02BF0CE901BF674602BFDC4602C0079A00C03A8E02C1BCF101C2151602C2610B01C2DEE401C2FD7C02C33EA300C36D8100C399F300C535C900C58D9002C5EA1602C6331902C75DD700C85C5902C8B83902C9389700CA072E02CA23B700CB533302CB74DA00CC495600CCEFEF00CDBA8302CE99E001CEE23E02CF1C0402CFF36501D0175600D0B00802D1D2A700D2638F02D2C12702D2CF9D02D2E67302D2ED3702D3140C02D3826100D3834B01D4489A01D4A04002D5398801D5F78602D6231F02D6EF5802D737C501D7D2C501D7E86C02D8E79C01D940E901D997E001DA0B7301DA38C801DB7A1402DB87DD01DBE23E02DBE56F02DC451502DC5C2B02DD1B1901DE0F8702DE692702DF294302E0093602E01FA101E0BC0102E1417E02E16D9901E17E8C00E193B001E1E3D801E21B5600E2BC8802E2DB2C02E4402701E469C900E4EF1B02E5BD5C01E5E03902E6109902E63E2B0DE66C8100E6BD3902E7A3E901E7A4D900E7E23E02E88E2401E98C0A01E9D36601E9EA3402EB3B9402EB8D3302EB908D02EC63C501EC95E101ECBC3602EDAA2E02EE165502EE5F9902EE930202EEAF9B02EFD67202F0694F02F07F0B02F0B91402F0E0B600F133E901F13A9102F1728102F17D5F00F1AD3D01F20E9302F2B4FA00F2FFA501F308DB00F3492A02F3658E02F3894001F3B82102F458EC01F4EA9502F5500D01F577C201F6F12B02F7125E00F7EC8302F7ED6A00F8C13D02F9DFA101FA667802FAFB8402FB8CC601FC3A4701FC75BA01FD148602FDB0D900FE784F02FE8D5E02FEDC8C01FEE26301FF10DD01FF3400023700060000000DEAFC0110BE880212F7C70113F7C7011A6F93021BA02E02212E4D0225C5010228614B022E240F022EDD89023C6AF901410189024BFC6D0251B2340261057C0263CB2E0269B992026A23E20170FC8802786C6D027A8B38027E018902877B32028B2894028EE3780299345802996776029E306B02A1866302AFA32E02B0D58102B5235202B6F13B02B8723E02BB635C02C1239D01C3445D02C8D15D02CF6C8502CFF42B02D88C3F02DBB95D02DCEF8E02DFD47602E2077F02E4718902EA5B9402EBAC7502EDF38E02EF007702F02A7402F0E23E02F7CC9002FC998D020500400100001ED770014B11B400682C9000A5ADCF00CE99E0010100420100009E1E9001010043010000C0EC7C0000"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "DF14000000000000040004000100050202000000003ADE0000B31C0200F76A010152B601020909020212F80002388F020285C70102E8C20103A63A0203CBE40103F91B02043E8E02045F9A0204931A0104AF630104DADC0105DE850205F9E70106C42802079A1902088D4201089E1902095E2F0209A336010A6B6C010BE8C5010BF99C020C3131020CE9C2000D28C7010D7879000D7E3E020D7E4F020DD3F9000E091A020E303E020E9F67020F168C01101755021043E800112969021142C20011AB3D0212E5F800130A360213951B0213E9780014FD160215E07E0216D134021793380117C06F0117DE370118208A02186C1E0219C0E2001A2D42021AE8EC011BF60B001C8FCF001C955C001D3083021D3BC5011D5819021E451E021EC330021ED770011F34CC011F626C022018F200213AC301223BED0122A7730123116E01237AF80123CC4F01246B460124ACC70024C18B0125023802254F6E01262B9401264BA801267F9D022834190228A11B012919DA0129450101297DA90129861F0229CE33022AC7DE002B2499002BD8E5012C9F7A022CA603022D22DA012D5838012E1EF0012E4A1C022E6974012E7714022F4CE5012FA8FF0131484F003257A400329F7A0232D1A70032D45F0133FB2A0233FE38023542CC0135602102361EE10139A7C20139AFDE013A99D9013B8031023CB352003D121F023D218F023DC47F023E1CB7013E5BED01403D670140A28E0141A8760041BC3A02420D510242264A0042B3AE0042C54D0243AB210144A4C401454ED30045668A024677300146AB2E02483BDB0148C24F0048F9A60049CBA30149DA1B0249EAB7004AAA81004AC433024ADEE1014B2A91014B6EE3014B7207024BF474024C15AA014C41B4004CC84B014D3ED9014E50C2014F14C2004FA53302508F000252769302534673015355E401536A3A025408340254302F0254B7DC0054DFE20155DB8C0155E6E10157426B01577AF801578A1B0257AD120158021202589E270258BB5C02594F87025953940059C43C025A0189025A0289025A0A83025AE213025AF783025B1203025C3598015E83D7015EF05F025F83500261D42A0261D98C0162DC300262EF34026396770063FD310264054E0264C9260164D4190164F42B0265A69E0065C4850265ED1D0267ABEE0167BA6B0268130102682C90006957EA0169592A0269CC4F016A3683026A61E8016A7365016A95E2016BF42B026C0B76026C137F026C6F66026CA164026D2390026DEE2C026E4538027052E20170A32C0271014902718C9A02726E4A0072A2420172CD990173422F0274A3A30175A37E007691CF0177D52F0277F98F01785DD30179DE980279F99C027A5B7C027C82C9017CBAFC017DBBD6017E1044017E3732027E5030027EEE89027F16AA017F88CA008001840281B0690281B942028227730082409702825B8A0282FB2A02833AC50183F16000844D260184D7780284E11E0284E6830085311B028550AE0085E34102861BDE0186ECB6018754990287D5140287F0250187FC38028881870288D13302890CE901892F830289DC8B018A8093008AFAE3008BEEF2008BFD6E018C1D88028C8F94028E78A2008E90C6018ED891018FEAF9019123D30091C335029259160092603302928271009369C70093CA3D0293CE8C019439F701945AE001945B270294A15B0195126E01959F33019697E30196A26E0198C7F10198D7780299429B02996776029A0B73019B4A72029C429B029C4D22029CE0A8009D9D92009E1E90019F8230029F8314029FF47702A1236602A19D2A01A2050600A2065D02A2961002A3998D02A3C4E200A3C88302A4580200A4778D02A4AEE901A5092E02A5ADCF00A644A600A6749502A7B8AD00A7C23301A7E23E02A8EA4E02AAB1FC01AAF63F02AB9FC901ABF42B02AC4D1C02AC54F900AC930202AD2DB801AD73BF00AE4D5702AEE69101AF086501AF9C0202B09E9702B0F13802B2376E01B2827902B2BAFC01B3732002B3742D02B392FB00B4D7C501B51B6701B5661202B7750C02B7E23E02B7F15002B8C37F02B91AF300B9B92A02B9FA7702BB51DD01BB8E1602BB8E8B00BBF42B02BD388F00BEAF8A02BF0CE901BF674602BFDC4602C0079A00C03A8E02C1BCF101C2151602C2610B01C2DEE401C2FD7C02C33EA300C36D8100C399F300C535C900C58D9002C5EA1602C6331902C75DD700C85C5902C8B83902C9389700CA072E02CA23B700CB533302CB74DA00CC495600CCEFEF00CDBA8302CE99E001CEE23E02CF1C0402CFF36501D0175600D0B00802D1D2A700D2638F02D2C12702D2CF9D02D2E67302D2ED3702D3140C02D3826100D3834B01D4489A01D4A04002D5398801D5F78602D6231F02D6EF5802D737C501D7D2C501D7E86C02D8E79C01D940E901D997E001DA0B7301DA38C801DB7A1402DB87DD01DBE23E02DBE56F02DC451502DC5C2B02DD1B1901DE0F8702DE692702DF294302E0093602E01FA101E0BC0102E1417E02E16D9901E17E8C00E193B001E1E3D801E21B5600E2BC8802E2DB2C02E4402701E469C900E4EF1B02E5BD5C01E5E03902E6109902E63E2B0DE66C8100E6BD3902E7A3E901E7A4D900E7E23E02E88E2401E98C0A01E9D36601E9EA3402EB3B9402EB8D3302EB908D02EC63C501EC95E101ECBC3602EDAA2E02EE165502EE5F9902EE930202EEAF9B02EFD67202F0694F02F07F0B02F0B91402F0E0B600F133E901F13A9102F1728102F17D5F00F1AD3D01F20E9302F2B4FA00F2FFA501F308DB00F3492A02F3658E02F3894001F3B82102F458EC01F4EA9502F5500D01F577C201F6F12B02F7125E00F7EC8302F7ED6A00F8C13D02F9DFA101FA667802FAFB8402FB8CC601FC3A4701FC75BA01FD148602FDB0D900FE784F02FE8D5E02FEDC8C01FEE26301FF10DD01FF3400023700060000000DEAFC0110BE880212F7C70113F7C7011A6F93021BA02E02212E4D0225C5010228614B022E240F022EDD89023C6AF901410189024BFC6D0251B2340261057C0263CB2E0269B992026A23E20170FC8802786C6D027A8B38027E018902877B32028B2894028EE3780299345802996776029E306B02A1866302AFA32E02B0D58102B5235202B6F13B02B8723E02BB635C02C1239D01C3445D02C8D15D02CF6C8502CFF42B02D88C3F02DBB95D02DCEF8E02DFD47602E2077F02E4718902EA5B9402EBAC7502EDF38E02EF007702F02A7402F0E23E02F7CC9002FC998D020500400100001ED770014B11B400682C9000A5ADCF00CE99E0010100420100009E1E9001010043010000C0EC7C0000"), "Setup.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\SOFTWARE\MICROSOFT\TIP\AGGREGATERESULTS"; Key: "DATA"; Value: "D9A7A80101000300EC03F46F00000000050000000000000049A8A801010203005C4614A6000000000C00000000000000D1A8A8010102030064B65611000000000C00000000000000D1A8A80101000400FB3B54EB00000000110000000000000023ACAD0102010400546DD0B400000000010000009D0000002B7ABA010202070017EB54670000000002000000070000009F49DD010100008045734BE1000000000A000000000000004959DD0101000400F34A296B00000000020000003E0400000C84EA010101010077F45746000000000100000012000000BFDE08020100008065B49D6B0000000004000000150000005F37110201000080856D77FF000000000200000007000000FDBE49020102008003520DB60000000002000000AA080000487C4D0201000080127A123700000000280000000500000093FE59020100010098FBB9D600000000010000000000000000"), "Start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000"), "Start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000"), "Start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000"), "Start.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000"), "Start.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "2206000000000000040004000102060000000000010000001C390B01010000002FD60F02010000006B507E0018000000795344025E000000A19F5E0001000000F062570204000100000054000000276B69013000000056737D00090000006B507E0009000000E6C5310002000400000001000000C49B7B0201000000EFBA8302020065000000CE0C0000E6C5310004000000F0E0B60000"), "Start.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\SOFTWARE\MICROSOFT\TIP\AGGREGATERESULTS"; Key: "DATA"; Value: "D9A7A80101000300EC03F46F00000000060000000000000049A8A801010203005C4614A6000000000C00000000000000D1A8A8010102030064B65611000000000C00000000000000D1A8A80101000400FB3B54EB00000000120000000000000023ACAD0102010400546DD0B400000000010000009D0000002B7ABA010202070017EB54670000000002000000070000009F49DD010100008045734BE1000000000A000000000000004959DD0101000400F34A296B00000000020000003E0400000C84EA010101010077F45746000000000100000012000000BFDE08020100008065B49D6B0000000004000000150000005F37110201000080856D77FF000000000200000007000000FDBE49020102008003520DB60000000002000000AA080000487C4D0201000080127A123700000000280000000500000093FE59020100010098FBB9D600000000010000000000000000")7a:T6b4,FindResourceW@KERNEL32.DLL at 00000000-00004648-49883-382-0040EE14 FindResourceW@KERNEL32.DLL at 00000000-00000972-52444-312-004230E4 FindResourceW@KERNEL32.DLL at 00000000-00000972-52444-362-00426A4C FindResourceW@KERNEL32.DLL at 00000000-00000972-52444-2775-0040AA2C FreeResource@KERNEL32.DLL at 00000000-00000972-52444-5503-00426ABB FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-373-00FC44E0 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-485-01018BC6 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-563-00FDC7F0 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-937-00FDCB26 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1151-00FD5BDF FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1207-00FD6669 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1248-00FC5A60 LockResource@KERNEL32.DLL at 00000000-00001368-57943-1249-00FDCA4C FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1275-00FC41B0 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1276-00FC40A0 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1277-00FC3FA0 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1288-00FC3434 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1313-00FC3E80 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1332-00FCE900 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1341-00FC9EC0 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1700-00FDC6DD FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1788-00FDF9F1 FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-1996-00FE9D0D FindResourceExW@KERNEL32.DLL at 00000000-00001368-57943-1998-00FFA30E FindResourceW@KERNEL32.DLL at 00000000-00001368-57943-3384-010277D37b:T74e,SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-244-004FA8F0 SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-3146-0042DD24 SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-3147-0042DE14 SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-3148-0042DF04 SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-3457-00450788 SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-3701-004655D8 SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-3823-00479D8C SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-3828-004690D4 SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-3829-0046902C SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-3952-0047A6A0 SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-3953-0047A670 SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-3999-0047A6FC SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-4042-0047A3B8 SystemParametersInfoW@USER32.DLL at 00000000-00000972-52444-4605-004BFA6C SystemParametersInfoW@USER32.DLL at 00000000-00001368-57943-435-0100E681 SystemParametersInfoW@USER32.DLL at 00000000-00001368-57943-446-0100E4EF SystemParametersInfoW@USER32.DLL at 00000000-00001368-57943-3101-0108C291 SystemParametersInfoW@USER32.DLL at 00000000-00001368-57943-3747-0103D581 SystemParametersInfoW@USER32.DLL at 00000000-00001368-57943-4095-01052732 SystemParametersInfoW@USER32.DLL at 00000000-00001368-57943-4563-01075728 SystemParametersInfoW@USER32.DLL at 00000000-00001368-57943-4689-010ADA5C SystemParametersInfoW@USER32.DLL at 00000000-00001368-57943-4754-010AF56F SystemParametersInfoW@USER32.DLL at 00000000-00001368-57943-4826-0107FCD4 SystemParametersInfoW@USER32.DLL at 00000000-00001368-57943-5438-0109FD95 SystemParametersInfoW@USER32.DLL at 00000000-00001368-57943-5570-010AFB9C7c:T75c,Found reference to API GetLongPathNameW@KERNEL32.DLL at 00000000-00004256-17811-39-00405BEC Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00004256-17811-384-004110C4 Found reference to API GetLongPathNameW@KERNEL32.DLL at 00000000-00005076-20827-53-00408174 Found reference to API GetMonitorInfoA@USER32.DLL at 00000000-00005076-20827-3352-0042D96C Found reference to API SetDllDirectoryW@KERNEL32.DLL at 00000000-00005076-20827-5473-005000C4 Found reference to API DeleteFileTransactedW@KERNEL32.DLL at 00000000-00000204-26125-1350-00E82520 Found reference to API GetGestureInfo@USER32.DLL at 00000000-00000204-26125-1588-00E76BB2 Found reference to API GetTouchInputInfo@USER32.DLL at 00000000-00000204-26125-1602-00E77493 Found reference to API RegisterTouchWindow@USER32.DLL at 00000000-00000204-26125-1605-00E78300 Found reference to API ApplicationRecoveryFinished@KERNEL32.DLL at 00000000-00000204-26125-1721-00E879D3 Found reference to API ApplicationRecoveryInProgress@KERNEL32.DLL at 00000000-00000204-26125-1722-00E87A28 Found reference to API GetLocaleInfoEx@KERNEL32.DLL at 00000000-00000204-26125-1729-00E87F29 Found reference to API GetThreadPreferredUILanguages@KERNEL32.DLL at 00000000-00000204-26125-1734-00E87FA4 Found reference to API RegisterApplicationRecoveryCallback@KERNEL32.DLL at 00000000-00000204-26125-1748-00E881F7 Found reference to API RegisterApplicationRestart@KERNEL32.DLL at 00000000-00000204-26125-1749-00E8825C Found reference to API CreateFileTransactedW@KERNEL32.DLL at 00000000-00000204-26125-1880-00E824A2 Found reference to API ChangeWindowMessageFilter@USER32.DLL at 00000000-00000204-26125-1970-00E87B93 Found reference to API RegDeleteKeyExW@KERNEL32.DLL at 00000000-00000204-26125-2214-00E8D5D9 Found reference to API GetFileAttributesTransactedW@KERNEL32.DLL at 00000000-00000204-26125-2482-00E98F067d:T46e,"SELECT Version FROM Win32_OperatingSystem" (Source: 00000000-00005048.00000000.116681.07380000.00000004.mdmp, Indicator: "select version from win32_operatingsystem") "SELECT * FROM Win32_USBControllerDevice" (Source: 00000000-00005048.00000000.116681.07380000.00000004.mdmp, Indicator: "select * from win32_usbcontrollerdevice") "SELECT * FROM Win32_PnPEntity WHERE DeviceID=" (Source: 00000000-00005048.00000000.116681.07380000.00000004.mdmp, Indicator: "select * from win32_pnpentity where deviceid=") "SELECT * FROM Win32_PnPEntity WHERE PNPDeviceID LIKE" (Source: 00000000-00005048.00000000.116681.07380000.00000004.mdmp, Indicator: "select * from win32_pnpentity where pnpdeviceid like") "SELECT * FROM Win32_PnPEntity WHERE PNPDeviceID LIKE '%VID[_]____&PID[_]____%'" (Source: 00000000-00005048.00000000.116681.07380000.00000004.mdmp, Indicator: "select * from win32_pnpentity where pnpdeviceid like '%vid[_]____&pid[_]____%'") "SELECT * FROM Win32_PnPEntity WHERE PNPDeviceID LIKE '%" (Source: 00000000-00005048.00000000.116681.07380000.00000004.mdmp, Indicator: "select * from win32_pnpentity where pnpdeviceid like '%")7e:Tac3,"window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\unins000.dat" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-GMF3M.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\config\is-I3PEL.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-2OGUL.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-MS1D1.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-SV2C2.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-T4ORH.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-GE9E4.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-6C559.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-6B3S9.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-D19VI.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-HHF19.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-31H01.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-4CE92.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-IVA2G.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-SVBUS.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-SDFV2.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-DJGR6.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-3HTG2.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-5RE1M.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-6JV83.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-5HLFC.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-34DO0.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-N5SOE.tmp" "window10iphoneunlockersetup.tmp" touched file "C:\Program Files (x86)\PassFab iPhone Unlocker\is-QSS4S.tmp"7f:T76f,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "window10 iphone unlocker setup") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "window10 iphone unlocker setup") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "window10 iphone unlocker setup") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "window10 iphone unlocker setup") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "window10 iphone unlocker setup") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "window10 iphone unlocker setup") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "window10 iphone unlocker setup") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "window10 iphone unlocker setup") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "window10 iphone unlocker setup") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000204.00000000.116507.00FE5000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00000204.00000000.116507.00FE5000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000204.00000000.116507.00FE5000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000204.00000000.116507.00FE5000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000204.00000000.116507.00FE5000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000204.00000000.116507.00FE5000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00000204.00000000.116507.00FE5000.00000002.mdmp")80:T4a2,Found string "SELECT Version FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00005048.00000000.116681.07380000.00000004.mdmp") Found string "SELECT * FROM Win32_USBControllerDevice" (Indicator: " Win32_USBController"; Source: "00000000-00005048.00000000.116681.07380000.00000004.mdmp") Found string "SELECT * FROM Win32_USBControllerDevice" (Indicator: " Win32_USBControllerDevice"; Source: "00000000-00005048.00000000.116681.07380000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE DeviceID=" (Indicator: " Win32_PnPEntity"; Source: "00000000-00005048.00000000.116681.07380000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE PNPDeviceID LIKE" (Indicator: " Win32_PnPEntity"; Source: "00000000-00005048.00000000.116681.07380000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE PNPDeviceID LIKE '%VID[_]____&PID[_]____%'" (Indicator: " Win32_PnPEntity"; Source: "00000000-00005048.00000000.116681.07380000.00000004.mdmp") Found string "SELECT * FROM Win32_PnPEntity WHERE PNPDeviceID LIKE '%" (Indicator: " Win32_PnPEntity"; Source: "00000000-00005048.00000000.116681.07380000.00000004.mdmp")81:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAABGZu7mZmQAAAAAAAAAAABm7u7u7u7uZgAAAAAAAAAG7u7u7u7u7u5kAAAAAAAG7u+O7u7u7u7u5mAAAAAAf/j/+O7u7u7u7u7mAAAABv/////u7u7u7u7u7mAAAAj////+7u7u7u7u7u5kAABuj///ju7u7u7u7u7u5gAG7uj///7oj/iO7u7u7u5gBu7uj////////47u7u7uYE7u7uj////////47u7u7uRu7u7uj////////47u7u7mbu7u7u///4jo///+7u7u5u7u7u6P//7u7u//+O7u7u7u7u7u//+O7u7o///u7u7u7u7u7v//7u7u7v//7u7u7u7u7u7//+7u7u7//+7u7u7u7u7u//+O7u7u///u7u7u7u7u7o///u7u7///7u7u7m7u7u6P//+O7v//+O7u7uZu7u7u7/////////7u7u7mTu7u7u7////////u7u7u5Abu7u7u7//////+7u7u7mAG7u7u7u6P///47u7u7u5gAG7u7u7u7uiO7u7u7u7mAABO7u7u7u7u7u7u7u7u5AAABu7u7u7u7u7u7u7u7mAAAABu7u7u7u7u7u7u7uYAAAAABu7u7u7u7u7u7u5gAAAAAABG7u7u7u7u7u5kAAAAAAAAAG7u7u7u7u7mAAAAAAAAAAAAZu7u7u5mAAAAAAD/wAP//wAA//wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAADwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790294895035,"unified_at":"2026-09-25T00:08:15.035Z","metadata":{"hashes":{"sha256":"f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","sha1":"980df4766088883f4a50b774e9f08dbcd36c16a2","md5":"c961c8ee8cc87501a269cd9586a7a8a4","sha512":"d1fea5583738e9efbc781d11fe739cafa36b5c9c11442cc32524dfa01f886ea60999d812a2bcded498ec350287db4a2318efa09280ae476a5b6a18327d8f5af7","ssdeep":"1572864:jTywYyD3xTrDTM1PWWAjKcubtsgcVYjzexgGmq4eKmOCJ:jTywYw9gYWAmcubtsgLzexn8s","ssdeep_chunks":["1572864:jTywYyD","1572864:TywYyD3","1572864:ywYyD3x","1572864:wYyD3xT","1572864:YyD3xTr","1572864:yD3xTrD","1572864:D3xTrDT","1572864:3xTrDTM","1572864:xTrDTM1","1572864:TrDTM1P","1572864:rDTM1PW","1572864:DTM1PWW","1572864:TM1PWWA","1572864:M1PWWAj","1572864:1PWWAjK","1572864:PWWAjKc","1572864:WWAjKcu","1572864:WAjKcub","1572864:AjKcubt","1572864:jKcubts","1572864:Kcubtsg","1572864:cubtsgc","1572864:ubtsgcV","1572864:btsgcVY","1572864:tsgcVYj","1572864:sgcVYjz","1572864:gcVYjze","1572864:cVYjzex","1572864:VYjzexg","1572864:YjzexgG","1572864:jzexgGm","1572864:zexgGmq","1572864:exgGmq4","1572864:xgGmq4e","1572864:gGmq4eK","1572864:Gmq4eKm","1572864:mq4eKmO","1572864:q4eKmOC","1572864:4eKmOCJ","3145728:jTywYyD","3145728:TywYyD3","3145728:ywYyD3x","3145728:wYyD3xT","3145728:YyD3xTr","3145728:yD3xTrD","3145728:D3xTrDT","3145728:3xTrDTM","3145728:xTrDTM1","3145728:TrDTM1P","3145728:rDTM1PW","3145728:DTM1PWW","3145728:TM1PWWA","3145728:M1PWWAj","3145728:1PWWAjK","3145728:PWWAjKc","3145728:WWAjKcu","3145728:WAjKcub","3145728:AjKcubt","3145728:jKcubts","3145728:Kcubtsg","3145728:cubtsgc","3145728:ubtsgcV","3145728:btsgcVY","3145728:tsgcVYj","3145728:sgcVYjz","3145728:gcVYjze","3145728:cVYjzex","3145728:VYjzexg","3145728:YjzexgG","3145728:jzexgGm","3145728:zexgGmq","3145728:exgGmq4","3145728:xgGmq4e","3145728:gGmq4eK","3145728:Gmq4eKm","3145728:mq4eKmO","3145728:q4eKmOC","3145728:4eKmOCJ","1572864:jTywYw9","1572864:TywYw9g","1572864:ywYw9gY","1572864:wYw9gYW","1572864:Yw9gYWA","1572864:w9gYWAm","1572864:9gYWAmc","1572864:gYWAmcu","1572864:YWAmcub","1572864:WAmcubt","1572864:Amcubts","1572864:mcubtsg","1572864:cubtsgL","1572864:ubtsgLz","1572864:btsgLze","1572864:tsgLzex","1572864:sgLzexn","1572864:gLzexn8","1572864:Lzexn8s"],"imphash":"20dd26497880c05caed9305b3c8b9109","pehash":"ea5b7020e6037e7060fd9b1b014d8d25df004d75"},"file_info":{"file_name":"Setup.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":76580760,"entropy":8,"compile_timestamp":"2016-04-06T14:39:04","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1631540071000,"last_seen":1789781225000,"last_multi_scan":1789781225000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":62020,"raw_size":62464},{"name":".itext","virtual_address":"0x11000","virtual_size":3940,"raw_size":4096},{"name":".data","virtual_address":"0x12000","virtual_size":3208,"raw_size":3584},{"name":".bss","virtual_address":"0x13000","virtual_size":22204},{"name":".idata","virtual_address":"0x19000","virtual_size":3588,"raw_size":4096},{"name":".tls","virtual_address":"0x1a000","virtual_size":8},{"name":".rdata","virtual_address":"0x1b000","virtual_size":24,"raw_size":512},{"name":".rsrc","virtual_address":"0x1c000","virtual_size":219592,"raw_size":219648}],"section_names":[".text",".itext",".data",".bss",".idata",".tls",".rdata",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":123},"sandbox_signatures":{"informative_count":366,"suspicious_count":19,"malicious_count":9,"total":394},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve system configuration"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Calls an APIs used to retrieve geographical location information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"malicious","value":"Terminates other processes using tskill/taskkill"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Able to access file/directory"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to lookup its own filename"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - Cryptographic algorithm using CryptoPP library"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Calls an APIs used to retrieve process information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Able to download remote files using web shell script"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"},{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Persistence","technique":"Device Registration","attack_id":"T1098.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1098/005","identifiers":[{"type":"informative","value":"Contains ability to register device notification handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"informative","value":"Attempts remote code execution into another process memory space"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decrypt/decode data"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Contains ability to retrieve information set for devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Able to manipulate a file/directory time format"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains references to the retrieval of internet session handle (imports API)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"suspicious","value":"Calls an API typically used to enumerate services"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking-related APIs"},{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"},{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"malicious","value":"Queries firmware table information (may be used to fingerprint/evade)"},{"type":"malicious","value":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Contains ability to copy files (API string)"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Uses cURL to communicate over HTTPS"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Imports crypto-related APIs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"},{"type":"informative","value":"Imports a library used to perform LDAP operation"}],"sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"tactic":"Collection","technique":"Archive via Utility","attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"YARA signature match - Detects 7zip files"}],"sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelgänging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Defense Evasion","technique":"Selective Exclusion","attack_id":"T1679","attack_id_wiki":"https://attack.mitre.org/techniques/T1679","identifiers":[{"type":"informative","value":"Attempts to rename multiple files with a new extension, avoiding critical system files"}],"sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]}],"sandbox_signatures":[{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Borland\\Delphi\\RTL\" in Source: sample.bin, \"Software\\Borland\\Locales\" in Source: sample.bin, \"Software\\Borland\\Delphi\\Locales\" in Source: sample.bin, \"Software\\CodeGear\\Locales\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"BAesY\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-324","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"BAesY\" (Indicator: \"Aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"r].cat\", Pattern match: \"http://schemas.microsof\", Pattern match: \"http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline\", Pattern match: \"t.com/smi/2005/windowssettings\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"3.0.6.14 \"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"Setup.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4310096'}\" (UID: 00000000-00003816)\n \"Setup.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5323400'}\" (UID: 00000000-00007116)\n \"Setup.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5323304'}\" (UID: 00000000-00007116)\n \"Setup.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5323352'}\" (UID: 00000000-00007116)\n \"Setup.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5323448'}\" (UID: 00000000-00007116)\n \"Setup.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5323384'}\" (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"Setup.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-NI9S7.tmp (UID: 00000000-00003816)\n \"Setup.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-GO4C5.tmp\\_isetup (UID: 00000000-00007116)\n \"Setup.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-GO4C5.tmp (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"Setup.exe\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"Setup.exe\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; File: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"Setup.exe\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"Setup.exe\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$27","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"_CFURLResponseSetCreationTime\" (Indicator: \"SetCreationTime\"; File: \"Setup.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Setup.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005840.00000000.155743.74179000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00005840.00000000.155743.00570000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007116.00000001.154161.00512000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x; Source: \"64710-1125-004B3678\")\n Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x; Source: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 72C00000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$28","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Setup.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Setup.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".textbss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"Setup.exe\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005840.00000000.155743.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007116-00000455-97217452836\")\n Found string \"C:\\inetpub\\PassFab iPhone Unlocker\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007116-00000455-108890918756\")\n Found string \":\\inetpub\\PassFab iPhone Unlocker\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005840.00000000.155743.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptProtectData\" which can \"perform encryption on the data\" [Source: is-V7L16.tmp]\n Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: is-V7L16.tmp]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains references to network communication API (string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005840-00000C2B-1430425122\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"Setup.exe\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"Setup.exe\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; File: \"Setup.exe\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getusergeoid\"; File: \"is-PV8A9.tmp\")\n file/memory contains long string with (Indicator: \"getgeoinfo\"; File: \"is-PV8A9.tmp\")\n file/memory contains long string with (Indicator: \"getusergeoid\"; File: \"is-1UC8K.tmp\")\n file/memory contains long string with (Indicator: \"getgeoinfo\"; File: \"is-1UC8K.tmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"Setup.exe\")\n Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; File: \"Setup.exe\")\n Found reference to API \"GetGeoInfoW\" (Indicator: \"getgeoinfo\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Setup.tmp\" called \"GetTickCount\" with parameters (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Setup.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003816)\n \"Setup.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003816)\n \"Setup.tmp\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00007116)\n \"Setup.tmp\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00007116)\n \"Setup.tmp\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007116)\n \"Setup.tmp\" called \"QueryPerformanceCounter\" (UID: 00000000-00007116)\n \"Setup.tmp\" called \"GetDiskFreeSpaceExW\" with parameters (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Setup.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003816)\n \"Setup.tmp\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"Observed import api PathFindFileName (Source: is-A1MCP.tmp)\n Observed import api PathFindFileName (Source: is-V7L16.tmp)\n Observed import api PathFindFileName (Source: is-46K6A.tmp)\n Observed import api PathFindFileName (Source: is-CQCML.tmp)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Setup.tmp\" called \"GetForegroundWindow\" (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Setup.tmp\" called \"IsWow64Process\" with parameter \"7116\" - (UID: 00000000-00007116)\n \"PassFab iPhone Unlocker.exe\" called \"IsWow64Process\" with parameter \"5840\" - (UID: 00000000-00005840)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"$2e","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$2f","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Setup.tmp\" called \"GetActiveWindow\" (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Setup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003816)\n \"Setup.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Setup.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003816)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: is-4JQOQ.tmp]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: is-BIV86.tmp]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: is-V7L16.tmp]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: is-9BSBF.tmp]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: is-M495I.tmp]\n Observed import api \"GetUserGeoID\" which can be \"used to retrieve geographical location of the user\" [Source: is-23FR4.tmp]\n Observed import api \"GetGeoInfo\" which can be \"used to retrieve geographical location\" [Source: is-23FR4.tmp]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Setup.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Setup.tmp]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp\")\n Found reference to API \"??_C@_0P@LKABJJMO@IsWow64Process@\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"Setup.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"Setup.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"Setup.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"Setup.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Setup.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp, 00000000-00005840.00000000.155743.74179000.00000002.mdmp, 00000000-00005840.00000000.155743.74482000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005840.00000000.155743.74111000.00000020.mdmp\")\n Found reference to API \"__crtGetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005840.00000000.155743.74111000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$32","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsW\" (Indicator: \"SetupDiGetClassDevs\"; File: \"Setup.exe\")\n Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"Setup.exe\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1480","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"Setup.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"Setup.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Setup.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp, 00000000-00005840.00000000.155743.74179000.00000002.mdmp, 00000000-00005840.00000000.155743.74482000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005840.00000000.155743.74111000.00000020.mdmp\")\n Found reference to API \"__crtGetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005840.00000000.155743.74111000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"Setup.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"Setup.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"Setup.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"Setup.exe\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; File: \"Setup.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"Setup.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"Setup.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver %1\" (Indicator: \"ver \") in Source: 00000000-00003816.00000000.152180.026C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system configuration","description":"Found string \"systeminfo\" (Indicator: \"systeminfo\"; Source: \"00000000-00005840.00000000.155743.09BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-359","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"tracert\"; File: \"is-GD1FD.tmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"Setup.exe\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"Setup.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"Setup.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"Setup.tmp\" queries volume information of \"C:\\\" at 00000000-00007116-00000C17-1420303034\n \"Setup.tmp\" queries volume information of \"C:\\\" at 00000000-00007116-00000C17-1420355666\n \"Setup.tmp\" queries volume information of \"C:\\\" at 00000000-00007116-00000C17-1420378926","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Start.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"PassFab iPhone Unlocker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"PassFab iPhone Unlocker.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Setup.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{PASSFAB IPHONE UNLOCKER}_IS1\")\n \"Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{PASSFAB IPHONE UNLOCKER}_IS1\")\n \"Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SETUP.TMP\")\n \"Start.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PASSFAB IPHONE UNLOCKER.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"Setup.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"Start.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; File: \"Setup.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"Setup.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"is-LCD4T.tmp\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"is-2JLLL.tmp\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"is-LDP29.tmp\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"is-SOEA8.tmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"Setup.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"Setup.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$37","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Setup.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-NI9S7.tmp\\Setup.tmp\" /SL5=\"$50240\n76048953\n295424\nC:\\Setup.exe\"\" - (UID: 00000000-00003816)\n \"Setup.tmp\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\cmd.exe\" /c taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" - (UID: 00000000-00007116)\n \"Setup.tmp\" called \"CreateProcessW\" with parameter \"\"C:\\inetpub\\PassFab iPhone Unlocker\\Start.exe\"\" - (UID: 00000000-00007116)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" - (UID: 00000000-00007924)\n \"Start.exe\" called \"CreateProcessW\" with parameter \"\"C:\\inetpub\\PassFab iPhone Unlocker\\PassFab iPhone Unlocker.exe\"\" - (UID: 00000000-00001192)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$39","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; File: \"is-G3UF9.tmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00005840.00000000.155743.096A2000.00000002.mdmp, 00000000-00005840.00000000.155743.09C12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"Fukey.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"Setup.exe\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyEx\" (Indicator: \"RegCreateKey\"; File: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"Setup.exe\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; File: \"Setup.exe\")\n Found reference to API \"RegCreateKeyEx\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-A1MCP.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-4JQOQ.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-LCR95.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-1KKJQ.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-9BSBF.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-M495I.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-23FR4.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-7M434.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-CQCML.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-R3LHR.tmp)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"ailed to LogonUser [\" (Indicator: \"LogonUser\"; Source: \"00000000-00005840.00000000.155743.09C12000.00000002.mdmp\")\n Found reference to API \"ailed to DuplicateToken after LogonUser. Error:\" (Indicator: \"LogonUser\"; Source: \"00000000-00005840.00000000.155743.09C12000.00000002.mdmp\")\n Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; Source: \"00000000-00005840.00000000.155743.09C12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; File: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileEx failed (%d).\" (Indicator: \"MoveFile\"; File: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"Setup.exe\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"Setup.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"Setup.exe\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; Source: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileEx failed (%d).\" (Indicator: \"MoveFile\"; Source: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"Setup.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"Setup.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003816.00000000.152180.00412000.00000004.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Setup.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"Setup.exe\")\n Found reference to API \"ShowWindowAsync\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005840.00000000.155743.096A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3c","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: is-4JQOQ.tmp)\n Found MoveFileExA in import section (Source: is-BIV86.tmp)\n Found MoveFileExW in import section (Source: is-V7L16.tmp)\n Found MoveFileExW in import section (Source: is-1KKJQ.tmp)\n Found MoveFileW in import section (Source: is-46K6A.tmp)\n Found MoveFileW in import section (Source: Setup.tmp)\n Found MoveFileExW in import section (Source: is-3JSDU.tmp)\n Found MoveFileExW in import section (Source: is-CQCML.tmp)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"$3d","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3e","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$3f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$40","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\"pSt.pSt.pSt\" (Indicator: \".pst\") in Source: 00000000-00005840.00000000.155743.02CD0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$41","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"PassFab iPhone Unlocker.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8d55d7cad944a3f21aeb1db491f3d6de\\mscorlib.ni.dll\" at 70F00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72A20000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Setup.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76DD0000\n \"Setup.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73270000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76DD0000\n \"Start.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76DD0000\n \"PassFab iPhone Unlocker.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76DD0000\n \"PassFab iPhone Unlocker.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 74360000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"PassFab iPhone Unlocker.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 72A60000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Setup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 775A0000\n \"Setup.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 775A0000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 775A0000\n \"taskkill.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 775A0000\n \"Start.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 775A0000\n \"PassFab iPhone Unlocker.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 775A0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$42","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$43","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"is-A1MCP.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-4JQOQ.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-BIV86.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-V7L16.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-M4VTM.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-LCR95.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-1KKJQ.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-9BSBF.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-46K6A.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-23FR4.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-7M434.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-3JSDU.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-CQCML.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-R3LHR.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$44","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"USER32.dll\" : \"222\" [Source: is-A1MCP.tmp]\n Observed large number of imported APIs from \"CFNetwork.dll\" : \"263\" [Source: is-4JQOQ.tmp]\n Observed large number of imported APIs from \"CoreFoundation.dll\" : \"732\" [Source: is-4JQOQ.tmp]\n Observed large number of imported APIs from \"CoreFoundation.dll\" : \"243\" [Source: is-BIV86.tmp]\n Observed large number of imported APIs from \"CoreFoundation.dll\" : \"322\" [Source: is-V7L16.tmp]\n Observed large number of imported APIs from \"libicuuc.dll\" : \"706\" [Source: is-M4VTM.tmp]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$45","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$46","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x183600\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x204600\" greater than 0x100000\n Raw size of \".text\" is \"0x1a1600\" greater than 0x100000\n Raw size of \".text\" is \"0x1e3600\" greater than 0x100000\n Raw size of \".text\" is \"0x197200\" greater than 0x100000\n Raw size of \".text\" is \"0x143c00\" greater than 0x100000\n Raw size of \".text\" is \"0x13ba00\" greater than 0x100000\n Raw size of \".text\" is \"0x13c200\" greater than 0x100000\n Raw size of \".text\" is \"0x136a00\" greater than 0x100000\n Raw size of \".text\" is \"0x10ca00\" greater than 0x100000\n Raw size of \".text\" is \"0x109800\" greater than 0x100000\n Raw size of \".text\" is \"0x105c00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x18354e\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x204448\" greater than 0x100000\n Virtual size of \".text\" is \"0x1a14bb\" greater than 0x100000\n Virtual size of \".text\" is \"0x1e3457\" greater than 0x100000\n Virtual size of \".text\" is \"0x197077\" greater than 0x100000\n Virtual size of \".text\" is \"0x143a10\" greater than 0x100000\n Virtual size of \".text\" is \"0x13b843\" greater than 0x100000\n Virtual size of \".text\" is \"0x13c124\" greater than 0x100000\n Virtual size of \".text\" is \"0x13686c\" greater than 0x100000\n Virtual size of \".text\" is \"0x10c98b\" greater than 0x100000\n Virtual size of \".text\" is \"0x10974d\" greater than 0x100000\n Virtual size of \".text\" is \"0x105a40\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"is-KD5P6.tmp\" has high imagebase \"0x61640000\"\n \"is-0493E.tmp\" has high imagebase \"0x66000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00007116-00000C46-19764244278]\n Observed system executable string:\"\"%WINDIR%\\system32\\cmd.exe\" /c taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" [Source: 00000000-00007116-00000C46-19764244278]\n Observed system executable string:\"%WINDIR%\\System32\\taskkill.exe\" [Source: 00000000-00007924-00000C46-1084370794]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00007924-00000BC0-1382386606]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\taskkill.exe\" [Source: 00000000-00007924-00000BC0-1382882380]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"Setup.tmp\" (UID: 00000000-00007116) was launched with new environment variables: \"__PROCESS_HISTORY=\"C:\\Setup.exe\", USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"Setup.tmp\" (UID: 00000000-00007116) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"taskkill.exe\" (UID: 00000000-00004616) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"Start.exe\" (UID: 00000000-00001192) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$47","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Setup.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Setup.tmp\" with commandline \"/SL5=\"$50240\n76048953\n295424\nC:\\\\Setup.exe\"\" (UID: 00000000-00007116)\n Spawned process \"cmd.exe\" with commandline \"/c taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" (UID: 00000000-00007924)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" (UID: 00000000-00004616)\n Spawned process \"Start.exe\" (UID: 00000000-00001192)\n Spawned process \"Start.exe\" (UID: 00000000-00001704)\n Spawned process \"PassFab iPhone Unlocker.exe\" (UID: 00000000-00005840)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"Setup.tmp\" with commandline \"/SL5=\"$50240\n76048953\n295424\nC:\\\\Setup.exe\"\" (UID: 00000000-00007116)\n Spawned process \"cmd.exe\" with commandline \"/c taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" (UID: 00000000-00007924)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" (UID: 00000000-00004616)\n Spawned process \"Start.exe\" (UID: 00000000-00001192)\n Spawned process \"Start.exe\" (UID: 00000000-00001704)\n Spawned process \"PassFab iPhone Unlocker.exe\" (UID: 00000000-00005840)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=DigiCert SHA2 Assured ID Timestamping CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: E1:D7:82:A8:E1:91:BE:EF:6B:CA:16:91:B5:AA:B4:94:A6:24:9B:F3; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 3B:A6:3A:6E:48:41:35:57:72:DE:BE:F9:CD:CF:4D:5A:F3:53:A2:97; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O=\"DigiCert\n Inc.\", C=US\" (SHA1: 59:FE:CD:A8:7C:47:9A:14:A8:2E:3E:F6:96:F9:E6:A9:00:2A:37:52; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$49","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Setup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-NI9S7.tmp\\Setup.tmp\"\n \"Setup.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-GO4C5.tmp\\_isetup\\_setup64.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts remote code execution into another process memory space","description":"\"Setup.exe\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"756\"\n \"BaseAddress\": \"0038B1E8\"\n \"Buffer\": \"0019ECDC\"\n \"NumberOfBytesToWrite\": \"00000004\"\n \"$name\": \"C:\\\\Users\\\\%OSUSER%\\\\AppData\\\\Local\\\\Temp\\\\is-NI9S7.tmp\\\\Setup.tmp\"}\n \"Setup.tmp\" called \"NtWriteVirtualMemory\" (UID: 00000000-00007116)\n \"Setup.tmp\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"1444\"\n \"BaseAddress\": \"006F41E8\"\n \"Buffer\": \"0019E2BC\"\n \"NumberOfBytesToWrite\": \"00000004\"\n \"$name\": \"C:\\\\Windows\\\\SysWOW64\\\\cmd.exe\"}\n \"Setup.tmp\" called \"NtWriteVirtualMemory\" with parameters {\"ProcessHandle\": \"1860\"\n \"BaseAddress\": \"011181E8\"\n \"Buffer\": \"0019DF44\"\n \"NumberOfBytesToWrite\": \"00000004\"\n \"$name\": \"C:\\\\inetpub\\\\PassFab iPhone Unlocker\\\\Start.exe\"}","origin":"API Call","mitre_attack_id":"T1055.002","relevance":1,"id":"api-315","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to register device notification handler (API string)","description":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1098.005","relevance":1,"id":"string-543","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Setup.tmp\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Start.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"PassFab iPhone Unlocker.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"is-47LI0.tmp\" has type \"XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators\" - Location: [C:\\inetpub\\PassFab iPhone Unlocker\\config\\is-47LI0.tmp]\n \"is-57J6K.tmp\" has type \"XML 1.0 document Unicode text UTF-8 (with BOM) text with CRLF line terminators\" - Location: [C:\\inetpub\\PassFab iPhone Unlocker\\is-57J6K.tmp]\n \"is-2B9AQ.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [C:\\inetpub\\PassFab iPhone Unlocker\\CoreFoundation.resources\\is-2B9AQ.tmp]\n \"is-M83M2.tmp\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [C:\\inetpub\\PassFab iPhone Unlocker\\is-M83M2.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$4b","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$4d","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Setup.exe\" queries basic process information of the \"C:\\Setup.exe\" (UID: 3816)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Setup.exe\" reads file \"c:\\setup.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to detect presence of virtual environment (API string)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"Setup.exe\" trying to touch file \"C:\\Setup.exe\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\AcGenral.dll\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\uxtheme.dll\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\winmm.dll\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\samcli.dll\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msacm32.dll\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\version.dll\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\userenv.dll\"\n \"Setup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\dwmapi.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Setup.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Setup.tmp\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Explorer\"\n \"Setup.tmp\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PassFab iPhone Unlocker.lnk\"\n \"Setup.tmp\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PassFab iPhone Unlocker\\Uninstall PassFab iPhone Unlocker.lnk\"\n \"Setup.tmp\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Setup.tmp\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer\"\n \"Start.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Start.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"Setup.tmp\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Desktop\\PassFab iPhone Unlocker.lnk\"\n \"Setup.tmp\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\PassFab iPhone Unlocker.lnk\"\n \"Setup.tmp\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PassFab iPhone Unlocker.lnk\"\n \"Setup.tmp\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PassFab iPhone Unlocker\\Uninstall PassFab iPhone Unlocker.lnk\"\n \"Setup.tmp\" trying to access LNK file \"%USERPROFILE%\\Desktop\\PassFab iPhone Unlocker.lnk\"\n \"Setup.tmp\" trying to access LNK file \"%PUBLIC%\\Desktop\\PassFab iPhone Unlocker.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Setup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-ni9s7.tmp\\setup.tmp\"\n \"Setup.exe\" writes file \"%temp%\\is-ni9s7.tmp\\setup.tmp\"\n \"Setup.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-go4c5.tmp\\_isetup\\_setup64.tmp\"\n \"Setup.tmp\" writes file \"c:\\inetpub\\passfab iphone unlocker\\is-nb28t.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"Start.exe\" writes a file \"C:\\inetpub\\PassFab iPhone Unlocker\\Logs\\NetFrameCheck.log\"\n \"PassFab iPhone Unlocker.exe\" writes a file \"C:\\inetpub\\PassFab iPhone Unlocker\\Logs\\2025-07-22.log\"\n \"Setup.tmp\" writes a file \"C:\\inetpub\\PassFab iPhone Unlocker\\unins000.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"is-423HL.tmp\")\n file/memory contains long string with (Indicator: \"getcomputernameexa\"; File: \"is-423HL.tmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"kCFStreamPropertySOCKSProxy\" (Indicator: \"socksproxy\"; File: \"Setup.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"HttpQueryInfoW\" (Indicator: \"HttpQueryInfo\"; File: \"Setup.exe\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"Setup.exe\")\n Found reference to API \"HttpQueryInfoA\" (Indicator: \"HttpQueryInfo\"; File: \"Setup.exe\")\n Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"Setup.exe\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"Setup.exe\")\n Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"Setup.exe\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"Setup.exe\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"Setup.exe\")\n Found reference to API \"HttpSendRequestExA\" (Indicator: \"HttpSendRequest\"; File: \"Setup.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")\n Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"Setup.exe\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"Setup.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"Setup.exe\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"Setup.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"Setup.exe\")\n Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"Setup.exe\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"Setup.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionA\" (Indicator: \"InternetQueryOption\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$51","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"Setup.exe\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"Setup.exe\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains references to the retrieval of internet session handle (imports API)","description":"Found InternetQueryOptionA in import section (Source: is-V7L16.tmp)","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-206","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"portuguese translation maintained by nars (nars@gmx.net)\" [Source: 00000000-00003816.00000000.152180.026C0000.00000004.mdmp]\n Observed email domain:\"spanish translation maintained by jorge andres brugger (jbrugger@gmx.net)\" [Source: 00000000-00003816.00000000.152180.026C0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$53","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetUserGetInfo\" which can \"retrieve information about a particular user account on a server.\" [Source: is-4JQOQ.tmp]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetCloseEnum\" which can \"end a network resource enumeration\" [Source: Setup.tmp]\n Observed import api \"WNetEnumResource\" which can \"continue an enumeration of network recls.sources\" [Source: Setup.tmp]\n Observed import api \"WNetGetConnection\" which can \"retrieve the name of the network resource associated with a local device\" [Source: Setup.tmp]\n Observed import api \"WNetGetUniversalName\" which can \"take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name\" [Source: Setup.tmp]\n Observed import api \"WNetOpenEnum\" which can \"start an enumeration of network recls.sources or existing connections.\" [Source: Setup.tmp]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"file/memory contains long string with (Indicator: \"libcurl\"; File: \"is-C6GCR.tmp\")\n file/memory contains long string with (Indicator: \"libcurl\"; File: \"is-SLHEB.tmp\")\n file/memory contains long string with (Indicator: \"libcurl\"; File: \"is-V57CC.tmp\")\n Found string \"C:\\inetpub\\PassFab iPhone Unlocker\\libcurl.dll\" (Indicator: \"libcurl\"; Source: \"00000000-00007116-00000455-84951985684\")\n Found string \"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\libcurl.dll\" (Indicator: \"libcurl\"; Source: \"00000000-00007116-00000455-96875529242\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"is-M495I.tmp\"\n YARA signature for AES encryption matched on file \"is-BIV86.tmp\"\n YARA signature for AES encryption matched on file \"is-GUR4M.tmp\"\n YARA signature for AES encryption matched on file \"is-9BSBF.tmp\"\n YARA signature for AES encryption matched on file \"is-CQCML.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"is-M495I.tmp\"\n YARA signature for Djb2 Hash Algorithm matched on file \"is-AQ9IB.tmp\"\n YARA signature for Djb2 Hash Algorithm matched on file \"is-9BSBF.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"is-AQ9IB.tmp\"\n YARA signature for embedded PE executable in .rsrc section matched on file \"is-A1MCP.tmp\"\n YARA signature for embedded PE executable in .rsrc section matched on file \"Setup.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"$54","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Zlib compression","description":"YARA signature for zlib compression library used in file \"is-LGJ68.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1560","relevance":2,"id":"yara-137","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"is-AQ9IB.tmp\"\n YARA signature matched on embedded PE in file \"is-A1MCP.tmp\"\n YARA signature matched on embedded PE in file \"Setup.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEFA47B8FE5DB11F4919D5665FAA69]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005840.00000000.155743.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005840.00000000.155743.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; File: \"is-3L6KM.tmp\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: is-A1MCP.tmp]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: is-LCR95.tmp]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: is-9BSBF.tmp]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: is-M495I.tmp]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: is-7M434.tmp]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: is-3JSDU.tmp]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: is-CQCML.tmp]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00005840.00000000.155743.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"Setup.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"Setup.exe\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"Setup.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"Setup.exe\")\n Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; File: \"Setup.exe\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: is-A1MCP.tmp]\n Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: is-1KKJQ.tmp]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"Setup.tmp\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Setup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Setup.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Start.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"PassFab iPhone Unlocker.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Setup.tmp\" called \"GetComputerNameW\" (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Setup.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"PassFab iPhone Unlocker.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Setup.tmp\" called \"GetUserNameW\" (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; File: \"Setup.exe\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"Setup.exe\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"Setup.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"Setup.exe\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; File: \"Setup.exe\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"Setup.exe\")\n Found reference to API \"GetDCOrgEx\" (Indicator: \"GetDC\"; File: \"Setup.exe\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; File: \"Setup.exe\")\n Found reference to API \"GetDCEx\" (Indicator: \"GetDC\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: is-A1MCP.tmp)\n Found GetCursorPos() in an import section (Source: Setup.tmp)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"Setup.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"Setup.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should PassFab iPhone Unlocker be installed?\" (Indicator: \"where \"; Source: \"00000000-00007116-00000455-37497803948\")\n Found string \"Where should Setup place the program's shortcuts?\" (Indicator: \"where \"; Source: \"00000000-00003816.00000000.152180.026C0000.00000004.mdmp\")\n Found string \"Where should [name] be installed?\" (Indicator: \"where \"; Source: \"00000000-00003816.00000000.152180.026C0000.00000004.mdmp\")\n Found string \"where otherwise noted, all of the documentation and software included\" (Indicator: \"where \"; Source: \"00000000-00003816.00000000.152180.026C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Found reference to API \"GetCurrentHwProfileA\" (Indicator: \"GetCurrentHwProfile\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; File: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$58","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"\"; File: \"is-QFAT9.tmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"PassFab iPhone Unlocker.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005840)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Setup.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: is-A1MCP.tmp]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Setup.tmp]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"Setup.exe\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"Setup.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"Setup.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005840.00000000.155743.74179000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: Setup.exe","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$5d","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Setup.tmp\" opened \"\\Device\\KsecDD\"\n \"PassFab iPhone Unlocker.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$5e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"Setup.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"Setup.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005840.00000000.155743.09C12000.00000002.mdmp, 00000000-00005840.00000000.155743.09F5B000.00000002.mdmp, 00000000-00005840.00000000.155743.0A0D7000.00000002.mdmp, 00000000-00005840.00000000.155743.73E2B000.00000002.mdmp, 00000000-00005840.00000000.155743.73E97000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Setup.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows 8 sections\"- Location: [%TEMP%\\is-NI9S7.tmp\\Setup.tmp]- [targetUID: 00000000-00003816]\n \"_setup64.tmp\" has type \"PE32+ executable (console) x86-64 for MS Windows 5 sections\"- Location: [%TEMP%\\is-GO4C5.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00007116]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$5f","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"Setup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Setup.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Start.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"PassFab iPhone Unlocker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$60","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"Setup.tmp\" called \"FileTimeToLocalFileTime\" with parameter be141a7740fbdb01 & be3cbbca05fbdb01 (UID: 00000000-00007116)\n \"Setup.tmp\" called \"FileTimeToLocalFileTime\" with parameter 958fb37640fbdb01 & 95b754ca05fbdb01 (UID: 00000000-00007116)\n \"Setup.tmp\" called \"FileTimeToSystemTime\" (UID: 00000000-00007116)\n \"Setup.tmp\" called \"FileTimeToLocalFileTime\" with parameter 0023cd4d897dd701 & 004b6ea14e7dd701 (UID: 00000000-00007116)\n \"Setup.tmp\" called \"FileTimeToLocalFileTime\" with parameter 006586039ba6d701 & 008d275760a6d701 (UID: 00000000-00007116)\n \"Setup.tmp\" called \"FileTimeToLocalFileTime\" with parameter 00def2ff9aa6d701 & 0006945360a6d701 (UID: 00000000-00007116)\n \"Setup.tmp\" called \"FileTimeToLocalFileTime\" with parameter 008b11e64fa4d701 & 00b3b23915a4d701 (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$62","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$63","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$64","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Setup.tmp\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"Setup.tmp\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"27\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate services","description":"\"Setup.tmp\" called \"EnumServicesStatusExW\" with parameters {\"hSCManager\": \"68b710\"\n \"dwServiceType\": \"48\"\n \"dwServiceState\": \"1\"}","origin":"API Call","mitre_attack_id":"T1007","relevance":5,"id":"api-174","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"Setup.tmp\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007116)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; File: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")\n Found string \"systeminfo\" (Indicator: \"systeminfo\"; Source: \"00000000-00005840.00000000.155743.09BC0000.00000004.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"00000000-00007116.00000000.152239.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$65","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"Setup.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"Start.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$66","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$67","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"is-3JSDU.tmp\" claims program is from Thu May 15 08:52:00 2087","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"Setup.tmp\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\cmd.exe\" /c taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" - (UID: 00000000-00007116)\n \"Start.exe\" called \"CreateProcessW\" with parameter \"\"C:\\inetpub\\PassFab iPhone Unlocker\\PassFab iPhone Unlocker.exe\"\" - (UID: 00000000-00001192)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"is-A1MCP.tmp has PE file in resource with name: \"EXE\" and filetype:PE32 executable (GUI) Intel 80386\n for MS Windows\n 5 sections\n is-A1MCP.tmp has PE file in resource with name: \"EXE\" and filetype:PE32 executable (GUI) Intel 80386\n for MS Windows\n 6 sections\n Setup.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (console) x86-64\n for MS Windows\n 5 sections\n Setup.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB)\n for MS Windows\n 4 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" (UID: 00000000-00004616)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"Start.exe\" called \"ShellExecuteW\" with parameter C:\\inetpub\\PassFab iPhone Unlocker\\PassFab iPhone Unlocker.exe (UID: 00000000-00001192)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Setup.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-NI9S7.tmp\\Setup.tmp\" (Handle: 756)\n \"Setup.tmp\" wrote 00000004 bytes to a remote process \"C:\\inetpub\\PassFab iPhone Unlocker\\Start.exe\" (Handle: 1860)\n \"Setup.tmp\" wrote 00000004 bytes to a remote process \"C:\\inetpub\\PassFab iPhone Unlocker\\Start.exe\" (Handle: 1816)\n \"cmd.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\taskkill.exe\" (Handle: 508)\n \"Start.exe\" wrote 00000004 bytes to a remote process \"C:\\inetpub\\PassFab iPhone Unlocker\\PassFab iPhone Unlocker.exe\" (Handle: 1328)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"Setup.exe\" (UID: 00000000-00003816)\n Spawned process \"Setup.tmp\" with commandline \"/SL5=\"$50240\n76048953\n295424\nC:\\\\Setup.exe\"\" (UID: 00000000-00007116)\n Spawned process \"cmd.exe\" with commandline \"/c taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" (UID: 00000000-00007924)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" (UID: 00000000-00004616)\n Spawned process \"Start.exe\" (UID: 00000000-00001192)\n Spawned process \"Start.exe\" (UID: 00000000-00001704)\n Spawned process \"PassFab iPhone Unlocker.exe\" (UID: 00000000-00005840)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"Setup.tmp\" touched \"K:\\\"\n \"Setup.tmp\" touched \"L:\\\"\n \"Setup.tmp\" touched \"M:\\\"\n \"Setup.tmp\" touched \"N:\\\"\n \"Setup.tmp\" touched \"O:\\\"\n \"Setup.tmp\" touched \"P:\\\"\n \"Setup.tmp\" touched \"Q:\\\"\n \"Setup.tmp\" touched \"R:\\\"\n \"Setup.tmp\" touched \"S:\\\"\n \"Setup.tmp\" touched \"T:\\\"\n \"Setup.tmp\" touched \"U:\\\"\n \"Setup.tmp\" touched \"V:\\\"\n \"Setup.tmp\" touched \"W:\\\"\n \"Setup.tmp\" touched \"X:\\\"\n \"Setup.tmp\" touched \"Y:\\\"","origin":"API Call","mitre_attack_id":"T1120","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"$68","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"Setup.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Setup.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"Setup.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00001368.00000000.139821.01145000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00001368.00000000.139821.01145000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameW@SHLWAPI.DLL at 00000000-00001368-57943-1875-00FF9475\n PathFindFileNameW@SHLWAPI.DLL at 00000000-00001368-57943-8014-01045943","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$69","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$6a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Setup.tmp\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001368-57943-52-01119EAB\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001368-57943-1928-01113A51\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001368-57943-6968-01114297\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00001368-57943-11468-0111442A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"Setup.exe\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"is-LDS5R.tmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"Setup.exe\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"Setup.exe\")\n Found reference to API \"CryptAcquireContextA\" (Indicator: \"CryptAcquireContextA\"; File: \"Setup.exe\")\n Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"Setup.exe\")\n Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"Setup.exe\")\n Found reference to API \"CryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"Setup.exe\")\n Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"Setup.exe\")\n Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"Setup.exe\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"Setup.exe\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Source: \"00000000-00000972.00000001.138643.00610000.00000004.mdmp, 00000000-00000972.00000002.139593.00637000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008076-00000C2C-1153703388\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"is-I49D5.tmp\")\n file/memory contains long string(File: \"is-LDS5R.tmp\")\n file/memory contains long string(File: \"is-BP8F3.tmp\")\n file/memory contains long string(File: \"is-DBLGV.tmp\")\n Found string \"function GetUserNameString: String;\" (Source: \"00000000-00000972.00000001.138643.00401000.00000020.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00000972.00000002.139593.02F50000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00000972.00000002.139593.02F50000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00000972.00000002.139593.02F50000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"1c:\\program files\\vmware\\vmware tools\\vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000972.00000001.138643.00610000.00000004.mdmp, 00000000-00000972.00000002.139593.00637000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"is-37V95.tmp\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000972.00000001.138643.7242D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"_setup64.tmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000972-00000C2C-1099622449\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"Setup.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"Setup.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00000972.00000000.136725.00512000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000972.00000000.136725.00512000.00000002.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000972.00000001.138643.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"EnumServicesStatusW\" (File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"Found string \"System.Home.DriveType\" (Indicator: \".drivetype\"; Source: \"00000000-00000972.00000002.139593.02F50000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1025","relevance":1,"id":"string-713","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: is-7B9LV.tmp]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: is-5UBTL.tmp]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: is-LSM3Q.tmp]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: is-FQFLT.tmp]\n Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: is-KJ78D.tmp]\n Observed import api \"GetUserGeoID\" which can be \"used to retrieve geographical location of the user\" [Source: is-I0NUQ.tmp]\n Observed import api \"GetGeoInfo\" which can be \"used to retrieve geographical location\" [Source: is-I0NUQ.tmp]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: Setup.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: is-IDG22.tmp]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"$6c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"$6d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00000972-52444-4624-004C0AE4\n GetDriveTypeW@KERNEL32.DLL at 00000000-00000972-52444-4632-004C0F14\n GetDriveTypeW@KERNEL32.DLL at 00000000-00000972-52444-4727-004CA018\n GetLogicalDriveStringsW@KERNEL32.DLL at 00000000-00001368-57943-1332-00FCE900","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000972-52444-172-004B2868\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00000972-52444-1111-004CC9E0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000972-52444-1125-004B3678\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000972-52444-4488-004B2824\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001368-57943-785-0112A71D\n FileTimeToSystemTime@KERNEL32.DLL at 00000000-00001368-57943-2475-00FF8D92\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00001368-57943-2485-00FF942C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001368-57943-6977-01114194","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000972-52444-172-004B2868\n GetLocalTime@KERNEL32.DLL at 00000000-00000972-52444-714-0040F594\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000972-52444-1125-004B3678\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000972-52444-4488-004B2824\n GetLocalTime@KERNEL32.DLL at 00000000-00000972-52444-4755-004CCEA4\n GetLocalTime@KERNEL32.DLL at 00000000-00000972-52444-4762-004CD490\n GetLocalTime@KERNEL32.DLL at 00000000-00000972-52444-5086-0040F544\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001368-57943-785-0112A71D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00001368-57943-6977-01114194","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00001368-57943-751-0112B3C5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$6e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00004648-49883-36-00405DE8\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004648-49883-51-00408F00\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004648-49883-58-00408EB4\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004648-49883-358-0040E640\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00000972-52444-36-00408370\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00000972-52444-51-0041100C\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00000972-52444-58-00410FC0\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00000972-52444-4468-004B0DAC\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00001368-57943-1729-00FE7F29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00004648-49883-250-00408068\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00000972-52444-2785-0040DC84\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00000972-52444-4464-004B0A78\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00001368-57943-1008-00FC9270\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00001368-57943-1330-00FC7F50\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00000000-00001368-57943-1332-00FCE900","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00004648-49883-91-00406458\n GetSystemInfo@KERNEL32.DLL at 00000000-00004648-49883-383-0040ED40\n GetSystemInfo@KERNEL32.DLL at 00000000-00000972-52444-91-00408DD0\n GetSystemInfo@KERNEL32.DLL at 00000000-00000972-52444-5176-004E69BC\n GetSystemInfo@KERNEL32.DLL at 00000000-00001368-57943-6999-01125C24","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"$6f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00000972-52444-956-004B00AC\n OpenProcessToken@ADVAPI32.DLL at 00000000-00000972-52444-4094-0047FFEC\n OpenProcessToken@ADVAPI32.DLL at 00000000-00000972-52444-4885-004D8C08\n OpenProcess@KERNEL32.DLL at 00000000-00000972-52444-5127-004FBCC8\n OpenProcess@KERNEL32.DLL at 00000000-00001368-57943-7198-00FCBDB8\n GetProcessHeap@KERNEL32.DLL at 00000000-00001368-57943-10222-0112C41E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyEx\" in file \"00000000-00000972.00000001.138643.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"Setup.exe\"\n Found registry modification API: \"RegCreateKeyTransactedW\" in file \"00000000-00001368.00000000.139821.00FC1000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyW\" in file \"Setup.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00000972.00000000.136725.00512000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00000972.00000001.138643.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00000972.00000001.138643.7242D000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyTransactedW\" in \"00000000-00001368.00000000.139821.01145000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"file/memory contains long string(File: \"is-HCMT6.tmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$71","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$72","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.DLL at 00000000-00000972-52444-1125-004B3678","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$73","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"$74","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$75","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$76","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"nars@gmx.net\"\n Pattern match: \"jbrugger@gmx.net\"\n Pattern match: \"peter.stadler@univie.ac.at\"\n Pattern match: \"pierre@levosgien.net\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$77","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"PassFab iPhone Unlocker.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 76C40000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"System.IsAttachment\" (Source: \"00000000-00000972.00000002.139593.02F50000.00000002.mdmp\")\n Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00000972.00000002.139593.02F50000.00000002.mdmp\")\n Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00000972.00000002.139593.02F50000.00000002.mdmp\")\n Found string \"System.Message.HasAttachments\" (Source: \"00000000-00000972.00000002.139593.02F50000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"Setup.tmp\" with commandline \"/SL5=\"$6037E\n76048953\n295424\nC:\\\\Setup.exe\"\" (UID: 00000000-00000972)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00000972-52444-908-004B0060","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00000972.00000000.136725.00512000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; File: \"Setup.exe\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"Setup.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResource\"; File: \"Setup.exe\")\n Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"Setup.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; File: \"00000000-00000972.00000001.138643.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; Source: \"00000000-00000972.00000001.138643.00401000.00000020.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000972.00000002.139593.006CD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Cryptographic algorithm using CryptoPP library","description":"YARA signature for Cryptographic function file \"is-KI8LN.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-178","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Detects 7zip files","description":"YARA signature for 7-Zip file file \"is-4KCIR.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1560.001","relevance":1,"id":"yara-176","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"is-L0700.tmp\"\n YARA signature for RSA public and private key matched on file \"is-2E8TB.tmp\"\n YARA signature for RSA public and private key matched on file \"is-EN4BI.tmp\"\n YARA signature for RSA public and private key matched on file \"is-N5C6B.tmp\"\n YARA signature for RSA public and private key matched on file \"is-85A0C.tmp\"\n YARA signature for RSA public and private key matched on file \"is-8NKM6.tmp\"\n YARA signature for RSA public and private key matched on file \"is-RU4FN.tmp\"\n YARA signature for RSA public and private key matched on file \"is-LDS5R.tmp\"\n YARA signature for RSA public and private key matched on file \"is-J3J0E.tmp\"\n YARA signature for RSA public and private key matched on file \"is-LVS16.tmp\"\n YARA signature for RSA public and private key matched on file \"is-QE1HM.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on file \"is-CQ6EQ.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00000972.00000000.136725.02750000.00000004.mdmp, 00000000-00000972.00000001.138643.02750000.00000004.mdmp, 00000000-00000972.00000001.138643.030C0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00004648-49883-347-0040E158\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00004648-49883-348-0040E11C\n Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00000972-52444-182-004ACF94\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00000972-52444-183-004ACF58","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"Setup.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"is-MI9A9.tmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00000972.00000001.138643.0018A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000972.00000001.138643.723D1000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000972.00000001.138643.7242D000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Credentials\" (Indicator: \"\\microsoft\\credentials\"; File: \"00000000-00000972.00000001.138643.00610000.00000004.mdmp, 00000000-00000972.00000002.139593.006CD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; File: \"00000000-00000972.00000001.138643.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"00000000-00000972.00000001.138643.00401000.00000020.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000972.00000002.139593.006CD000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Setup.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\CMD.EXE\"; Value: \"89D407BD3EA6DC010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"System Security","name":"Imports a library used to perform LDAP operation","description":"Observed import dll \"wldap32.dll\" which can perform LDAP operation [Source: is-FQFLT.tmp]\n Observed import dll \"wldap32.dll\" which can perform LDAP operation [Source: is-KJ78D.tmp]","origin":"Static Parser","mitre_attack_id":"T1069.002","relevance":3,"id":"static-225","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$79","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetLongPathNameW\" (Source: Setup.exe, API is part of module: KERNELBASE.DLL)\n Found string \"SetDefaultDllDirectories\" (Source: Setup.exe, API is part of module: KERNELBASE.DLL)\n Found string \"SetDllDirectoryW\" (Source: Setup.exe, API is part of module: KERNEL32.DLL)\n Found string \"SetSearchPathMode\" (Source: Setup.exe, API is part of module: KERNEL32.DLL)\n Found string \"SetProcessDEPPolicy\" (Source: Setup.exe, API is part of module: KERNEL32.DLL)\n Found string \"Wow64DisableWow64FsRedirection\" (Source: Setup.exe, API is part of module: KERNELBASE.DLL)\n Found string \"Wow64RevertWow64FsRedirection\" (Source: Setup.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"$7a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"$7b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00000972-52444-3386-00409BCC\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00000972-52444-3490-004535D0\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00000972-52444-3647-00460848\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00000972-52444-4061-0047BC08\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00000972-52444-4064-0047BD0C\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00000972-52444-4477-004B2358","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeW\" (Indicator: \"RpcStringFree\"; File: \"window10 iphone unlocker setup\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"window10iphoneunlockersetup.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"window10iphoneunlockersetup.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"window10iphoneunlockersetup.tmp\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"window10iphoneunlockersetup.tmp\" set its error mode to SEM_FAILCRITICALERRORS\n \"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"taskkill.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"Start.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Start.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"$7c","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \"mkdir \"; File: \"is-AJCU7.tmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-779","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; Source: \"00000000-00000204.00000000.116507.00FE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"Found string \"Could not instantiate SimpleDateFormatter with [\" (Indicator: \"simpledateformat\"; Source: \"00000000-00005048.00000000.116681.07380000.00000004.mdmp\")\n Found string \"simpledateformatter\" (Indicator: \"simpledateformat\"; Source: \"00000000-00005048.00000000.116681.0C3F0000.00000004.mdmp, 00000000-00005048.00000001.117268.0C3F0000.00000004.mdmp\")\n Found string \"ould not instantiate SimpleDateFormatter with [\" (Indicator: \"simpledateformat\"; Source: \"00000000-00005048.00000001.117268.0C592000.00000002.mdmp\")\n Found string \"GetLastWriteTimeUtc\" (Indicator: \"getlastwritetime\"; Source: \"00000000-00005048.00000001.117268.0C592000.00000002.mdmp\")\n Found string \"GetLastWriteTime\" (Indicator: \"getlastwritetime\"; Source: \"00000000-00005048.00000001.117268.0C592000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"window10 iphone unlocker setup\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"window10 iphone unlocker setup\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM Win32_USBControllerDevice\" (Indicator: \"select * from \"; Source: \"00000000-00005048.00000000.116681.07380000.00000004.mdmp\")\n Found string \"SELECT * FROM Win32_PnPEntity WHERE DeviceID=\" (Indicator: \"select * from \"; Source: \"00000000-00005048.00000000.116681.07380000.00000004.mdmp\")\n Found string \"SELECT * FROM Win32_PnPEntity WHERE PNPDeviceID LIKE\" (Indicator: \"select * from \"; Source: \"00000000-00005048.00000000.116681.07380000.00000004.mdmp\")\n Found string \"SELECT * FROM Win32_PnPEntity WHERE PNPDeviceID LIKE '%VID[_]____&PID[_]____%'\" (Indicator: \"select * from \"; Source: \"00000000-00005048.00000000.116681.07380000.00000004.mdmp\")\n Found string \"SELECT * FROM Win32_PnPEntity WHERE PNPDeviceID LIKE '%\" (Indicator: \"select * from \"; Source: \"00000000-00005048.00000000.116681.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000204.00000000.116507.00FE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00005048.00000000.116681.07380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00005048.00000001.117268.05630000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$7e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files using web shell script","description":"file/memory contains long string with (Indicator: \"HttpWebRequest\"; File: \"is-31H01.tmp\")\n file/memory contains long string with (Indicator: \"HttpWebRequest\"; File: \"is-GE9E4.tmp\")\n Found string \"HttpWebRequest\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00005048.00000001.117268.093B2000.00000002.mdmp, 00000000-00005048.00000001.117268.0CE92000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-798","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap --open\"; File: \"is-UH8AP.tmp\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00005048.00000001.117268.093B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Ransomware/Banking","name":"Attempts to rename multiple files with a new extension, avoiding critical system files","description":"\"window10iphoneunlockersetup.tmp\" appended encryption extension \".dll\" to 10+ files (.tmp)","origin":"API Call","mitre_attack_id":"T1679","relevance":1,"id":"api-325","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00000204.00000000.116507.00FE5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"function GetUserNameString: String;\" (Indicator: \"GetUserName\"; File: \"00000000-00005076.00000000.113183.00401000.00000020.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"window10 iphone unlocker setup\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"window10 iphone unlocker setup\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"window10iphoneunlockersetup.tmp\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005076)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Start.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$80","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"PassFab iPhone Unlocker.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\PassFab iPhone Unlocker.exe.log]- [targetUID: 00000000-00005048]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"window10iphoneunlockersetup.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-GPS3I.tmp\\window10iphoneunlockersetup.tmp\" for deletion\n \"window10iphoneunlockersetup.tmp\" marked \"C:\\Program Files (x86)\\PassFab iPhone Unlocker\\msvcp140.dll\" for deletion\n \"window10iphoneunlockersetup.tmp\" marked \"C:\\Program Files (x86)\\PassFab iPhone Unlocker\\ucrtbase.dll\" for deletion\n \"window10iphoneunlockersetup.tmp\" marked \"C:\\Program Files (x86)\\PassFab iPhone Unlocker\\vcruntime140.dll\" for deletion\n \"window10iphoneunlockersetup.tmp\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-9HUPI.tmp\\_isetup\\_setup64.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Queries firmware table information (may be used to fingerprint/evade)","description":"\"PassFab iPhone Unlocker.exe\" at 00000000-00005048-00000C15-829056367\n \"PassFab iPhone Unlocker.exe\" at 00000000-00005048-00000C15-829056437\n \"PassFab iPhone Unlocker.exe\" at 00000000-00005048-00000C15-829056494\n \"PassFab iPhone Unlocker.exe\" at 00000000-00005048-00000C15-829105771","origin":"API Call","mitre_attack_id":"T1120","relevance":10,"id":"api-65","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"window10iphoneunlockersetup.exe\" (UID: 00000000-00004256)\n Spawned process \"window10iphoneunlockersetup.tmp\" with commandline \"/SL5=\"$B0376\n76048953\n295424\nC:\\\\window10iphoneunlockersetup.exe\"\" (UID: 00000000-00005076)\n Spawned process \"cmd.exe\" with commandline \"/c taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" (UID: 00000000-00007364)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"\" (UID: 00000000-00006600)\n Spawned process \"Start.exe\" (UID: 00000000-00006780)\n Spawned process \"Start.exe\" (UID: 00000000-00000204)\n Spawned process \"PassFab iPhone Unlocker.exe\" (UID: 00000000-00005048)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]}],"intel_graph":{"map":{"File:1100ed9448c3c466977a5c32d2e74e92d1c80db4cd8079014f028e48d2dc8883":{"type":"File","value":"1100ed9448c3c466977a5c32d2e74e92d1c80db4cd8079014f028e48d2dc8883"},"File:12810b32b5ae54ffdd80c392e3762dda094af65bcc4b2e946b9e5fd9ac7ef904":{"type":"File","value":"12810b32b5ae54ffdd80c392e3762dda094af65bcc4b2e946b9e5fd9ac7ef904"},"File:258e814b6a82a6b11efa76a9bb63575465f27a49038cf953232bb2849e99f906":{"type":"File","value":"258e814b6a82a6b11efa76a9bb63575465f27a49038cf953232bb2849e99f906"},"File:388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95":{"type":"File","value":"388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95"},"File:38ee033b1ae499023d547532bb5c4dabdf2e7cef8db2dab0a2ef86762d47c44e":{"type":"File","value":"38ee033b1ae499023d547532bb5c4dabdf2e7cef8db2dab0a2ef86762d47c44e"},"File:3bff46313bebd0dc446e19906fee1bd1da763d7fbae8c0a30178f72e88d4e0fd":{"type":"File","value":"3bff46313bebd0dc446e19906fee1bd1da763d7fbae8c0a30178f72e88d4e0fd"},"File:6a99ef06a120238f797b3488277603fade37ed36c36278707fdef5ece32bdf07":{"type":"File","value":"6a99ef06a120238f797b3488277603fade37ed36c36278707fdef5ece32bdf07"},"File:74acfcd628e2e89ffb6f10d92d97c019e16bd1ba93b3f054b5f1a220dde2dd58":{"type":"File","value":"74acfcd628e2e89ffb6f10d92d97c019e16bd1ba93b3f054b5f1a220dde2dd58"},"File:74dd52511cedb19d1fdff2eccf80f4c36c48b7335be84e7a6349cf956fb77786":{"type":"File","value":"74dd52511cedb19d1fdff2eccf80f4c36c48b7335be84e7a6349cf956fb77786"},"File:7d0a7a10a5bfa8be66116957707a545ec59665d16476138c8947f4892375327b":{"type":"File","value":"7d0a7a10a5bfa8be66116957707a545ec59665d16476138c8947f4892375327b"},"File:87b4c300541166546dbc8d6ef71f6daf80e8e4b6b0724d6a3838bd9f709235e4":{"type":"File","value":"87b4c300541166546dbc8d6ef71f6daf80e8e4b6b0724d6a3838bd9f709235e4"},"File:92b616861ae4f59a318a9f30170f05a45ca199b4cc088414808d2a42747fb634":{"type":"File","value":"92b616861ae4f59a318a9f30170f05a45ca199b4cc088414808d2a42747fb634"},"File:995b3f4fb4634a0cadd1286d7b45d8cc9d628d8d14443056f0d2f8eef6842885":{"type":"File","value":"995b3f4fb4634a0cadd1286d7b45d8cc9d628d8d14443056f0d2f8eef6842885"},"File:9def8ca5d38541c057cb079ea62a7ce508f7cd5d601b9012cd16506812f8bb91":{"type":"File","value":"9def8ca5d38541c057cb079ea62a7ce508f7cd5d601b9012cd16506812f8bb91"},"File:9e660848676a0fdff6b6f6ae68973fd99b670349a36ad7ebc56a319cab766839":{"type":"File","value":"9e660848676a0fdff6b6f6ae68973fd99b670349a36ad7ebc56a319cab766839"},"File:a6a7f917e16619f66df619ea6ca6dab8590d697169a5e37d208fb2579270ec2f":{"type":"File","value":"a6a7f917e16619f66df619ea6ca6dab8590d697169a5e37d208fb2579270ec2f"},"File:b1ddb85162fb7ae93387b80a75ba4d48511bae0ac5c8ed53c39b054584c3198d":{"type":"File","value":"b1ddb85162fb7ae93387b80a75ba4d48511bae0ac5c8ed53c39b054584c3198d"},"File:ba7305a291fedc3234a4c6fc2a751df30842b619ad120687709fa2bd112b0e0d":{"type":"File","value":"ba7305a291fedc3234a4c6fc2a751df30842b619ad120687709fa2bd112b0e0d"},"File:c046b7a995626a4de92329301dee8d89076c2d82108aa3a00100aade8661c58d":{"type":"File","value":"c046b7a995626a4de92329301dee8d89076c2d82108aa3a00100aade8661c58d"},"File:d1321ff0de3719fddc55357f0e5af6af04530f40d173d5398f9c7fa4a734bcdc":{"type":"File","value":"d1321ff0de3719fddc55357f0e5af6af04530f40d173d5398f9c7fa4a734bcdc"},"File:d8a3394398c0083b1a3a4a8ffccab7bc5946cf582e2fb22312f5b3642df06336":{"type":"File","value":"d8a3394398c0083b1a3a4a8ffccab7bc5946cf582e2fb22312f5b3642df06336"},"File:ea8fc9192d60a78820da393baff637152404078202007c8a4597c1c029cd2bc9":{"type":"File","value":"ea8fc9192d60a78820da393baff637152404078202007c8a4597c1c029cd2bc9"},"File:f2c854966337cbbca1d087524b1057049fad65ad08ccb30fa936f45e567f902c":{"type":"File","value":"f2c854966337cbbca1d087524b1057049fad65ad08ccb30fa936f45e567f902c"},"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970":{"type":"File","value":"f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f6e16cf7e112a4efe415a2357e4d5142bc0bc9edf322dc3c74e3706bc6071851":{"type":"File","value":"f6e16cf7e112a4efe415a2357e4d5142bc0bc9edf322dc3c74e3706bc6071851","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:fe47c21a5b34cc6634716835c71afbe289581b90fdb4dc45165e25fe28f67aeb":{"type":"File","value":"fe47c21a5b34cc6634716835c71afbe289581b90fdb4dc45165e25fe28f67aeb"}},"chains":[{"id":"1550684017029709164","root":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:f6e16cf7e112a4efe415a2357e4d5142bc0bc9edf322dc3c74e3706bc6071851"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","edges":[{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:f6e16cf7e112a4efe415a2357e4d5142bc0bc9edf322dc3c74e3706bc6071851"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:d8a3394398c0083b1a3a4a8ffccab7bc5946cf582e2fb22312f5b3642df06336"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:38ee033b1ae499023d547532bb5c4dabdf2e7cef8db2dab0a2ef86762d47c44e"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:6a99ef06a120238f797b3488277603fade37ed36c36278707fdef5ece32bdf07"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:b1ddb85162fb7ae93387b80a75ba4d48511bae0ac5c8ed53c39b054584c3198d"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:7d0a7a10a5bfa8be66116957707a545ec59665d16476138c8947f4892375327b"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:f2c854966337cbbca1d087524b1057049fad65ad08ccb30fa936f45e567f902c"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:12810b32b5ae54ffdd80c392e3762dda094af65bcc4b2e946b9e5fd9ac7ef904"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:ba7305a291fedc3234a4c6fc2a751df30842b619ad120687709fa2bd112b0e0d"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:9e660848676a0fdff6b6f6ae68973fd99b670349a36ad7ebc56a319cab766839"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:fe47c21a5b34cc6634716835c71afbe289581b90fdb4dc45165e25fe28f67aeb"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:87b4c300541166546dbc8d6ef71f6daf80e8e4b6b0724d6a3838bd9f709235e4"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:ea8fc9192d60a78820da393baff637152404078202007c8a4597c1c029cd2bc9"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:d1321ff0de3719fddc55357f0e5af6af04530f40d173d5398f9c7fa4a734bcdc"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:995b3f4fb4634a0cadd1286d7b45d8cc9d628d8d14443056f0d2f8eef6842885"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:3bff46313bebd0dc446e19906fee1bd1da763d7fbae8c0a30178f72e88d4e0fd"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:a6a7f917e16619f66df619ea6ca6dab8590d697169a5e37d208fb2579270ec2f"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:c046b7a995626a4de92329301dee8d89076c2d82108aa3a00100aade8661c58d"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:74acfcd628e2e89ffb6f10d92d97c019e16bd1ba93b3f054b5f1a220dde2dd58"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:6a99ef06a120238f797b3488277603fade37ed36c36278707fdef5ece32bdf07"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:38ee033b1ae499023d547532bb5c4dabdf2e7cef8db2dab0a2ef86762d47c44e"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:f2c854966337cbbca1d087524b1057049fad65ad08ccb30fa936f45e567f902c"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:12810b32b5ae54ffdd80c392e3762dda094af65bcc4b2e946b9e5fd9ac7ef904"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:ba7305a291fedc3234a4c6fc2a751df30842b619ad120687709fa2bd112b0e0d"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:9e660848676a0fdff6b6f6ae68973fd99b670349a36ad7ebc56a319cab766839"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:fe47c21a5b34cc6634716835c71afbe289581b90fdb4dc45165e25fe28f67aeb"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:87b4c300541166546dbc8d6ef71f6daf80e8e4b6b0724d6a3838bd9f709235e4"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:ea8fc9192d60a78820da393baff637152404078202007c8a4597c1c029cd2bc9"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:d1321ff0de3719fddc55357f0e5af6af04530f40d173d5398f9c7fa4a734bcdc"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:995b3f4fb4634a0cadd1286d7b45d8cc9d628d8d14443056f0d2f8eef6842885"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:3bff46313bebd0dc446e19906fee1bd1da763d7fbae8c0a30178f72e88d4e0fd"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:a6a7f917e16619f66df619ea6ca6dab8590d697169a5e37d208fb2579270ec2f"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:c046b7a995626a4de92329301dee8d89076c2d82108aa3a00100aade8661c58d"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:74acfcd628e2e89ffb6f10d92d97c019e16bd1ba93b3f054b5f1a220dde2dd58"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:38ee033b1ae499023d547532bb5c4dabdf2e7cef8db2dab0a2ef86762d47c44e"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:6a99ef06a120238f797b3488277603fade37ed36c36278707fdef5ece32bdf07"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:1100ed9448c3c466977a5c32d2e74e92d1c80db4cd8079014f028e48d2dc8883"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:f2c854966337cbbca1d087524b1057049fad65ad08ccb30fa936f45e567f902c"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:12810b32b5ae54ffdd80c392e3762dda094af65bcc4b2e946b9e5fd9ac7ef904"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:ba7305a291fedc3234a4c6fc2a751df30842b619ad120687709fa2bd112b0e0d"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:9e660848676a0fdff6b6f6ae68973fd99b670349a36ad7ebc56a319cab766839"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:fe47c21a5b34cc6634716835c71afbe289581b90fdb4dc45165e25fe28f67aeb"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:87b4c300541166546dbc8d6ef71f6daf80e8e4b6b0724d6a3838bd9f709235e4"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:ea8fc9192d60a78820da393baff637152404078202007c8a4597c1c029cd2bc9"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:d1321ff0de3719fddc55357f0e5af6af04530f40d173d5398f9c7fa4a734bcdc"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:995b3f4fb4634a0cadd1286d7b45d8cc9d628d8d14443056f0d2f8eef6842885"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:3bff46313bebd0dc446e19906fee1bd1da763d7fbae8c0a30178f72e88d4e0fd"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:a6a7f917e16619f66df619ea6ca6dab8590d697169a5e37d208fb2579270ec2f"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:c046b7a995626a4de92329301dee8d89076c2d82108aa3a00100aade8661c58d"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:74acfcd628e2e89ffb6f10d92d97c019e16bd1ba93b3f054b5f1a220dde2dd58"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:9def8ca5d38541c057cb079ea62a7ce508f7cd5d601b9012cd16506812f8bb91"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:92b616861ae4f59a318a9f30170f05a45ca199b4cc088414808d2a42747fb634"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:74dd52511cedb19d1fdff2eccf80f4c36c48b7335be84e7a6349cf956fb77786"},{"edge_kind":"extracted","from_key":"File:f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","to_key":"File:258e814b6a82a6b11efa76a9bb63575465f27a49038cf953232bb2849e99f906"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":112,"imported_dlls_count":162,"dropped_files_count":0,"extracted_files_count":55,"files_written_count":191,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6aade4e206bdc687740dbe67","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"submit_name":"window10 iphone unlocker setup","analysis_start_time":"2026-09-19T01:27:09+00:00","indicators_count":{"informative":279,"suspicious":82,"malicious":6},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"699e5965dcfa18c7d903ab37","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":100,"submit_name":"Setup.exe","analysis_start_time":"2026-02-25T02:07:49+00:00","indicators_count":{"informative":320,"suspicious":98,"malicious":6},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"687f867d7f68a2d2cf085638","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Setup.exe","analysis_start_time":"2025-07-22T12:39:34+00:00","indicators_count":{"informative":267,"suspicious":76,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true},{"id":"613f5364c7d05f6c224cacbd","environment_id":120,"environment_description":"Windows 7 64 bit","state":"ERROR","error_type":"The size of the file is 0 (zero) bytes","verdict":"undetected","submit_name":"Setup.exe","analysis_start_time":"2021-09-13T13:34:30+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}],"processes":[{"pid":3816,"ppid":0,"name":"Setup.exe","command_line":"","sha256":"f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970","normalized_path":"C:\\Setup.exe","uid":"00000000-00003816","icon":"$81"},{"pid":7116,"ppid":3816,"name":"Setup.tmp","command_line":"/SL5=\"$50240,76048953,295424,C:\\Setup.exe\"","sha256":"d8a3394398c0083b1a3a4a8ffccab7bc5946cf582e2fb22312f5b3642df06336","normalized_path":"%TEMP%\\is-NI9S7.tmp\\Setup.tmp","parent_uid":"00000000-00003816","uid":"00000000-00007116"},{"pid":7924,"ppid":7116,"name":"cmd.exe","command_line":"/c taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"","sha256":"678652bb50abb92de91a69c05ea018c160fb4be0902ace14b15749246788cb40","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00007116","uid":"00000000-00007924"},{"pid":4616,"ppid":7924,"name":"taskkill.exe","command_line":"taskkill /f /t /im \"PassFab iPhone Unlocker.exe\"","sha256":"bf1f32a3aaa946bb295b182c14482721dfb431e1c4e5622b6f4207f3b5c3d9e0","normalized_path":"%WINDIR%\\SysWOW64\\taskkill.exe","parent_uid":"00000000-00007924","uid":"00000000-00004616"},{"pid":1192,"ppid":7116,"name":"Start.exe","command_line":"","sha256":"2fc93c927d77d430ff3e3309b94970cdedf45706c8c765e439234ff100b32691","normalized_path":"C:\\inetpub\\PassFab iPhone Unlocker\\Start.exe","parent_uid":"00000000-00007116","uid":"00000000-00001192"},{"pid":5840,"ppid":1192,"name":"PassFab iPhone Unlocker.exe","command_line":"","sha256":"c82b0af531d28428390d0151828bc12aea6e322279661b48a4b9da3499a98dc8","normalized_path":"C:\\inetpub\\PassFab iPhone Unlocker\\PassFab iPhone Unlocker.exe","parent_uid":"00000000-00001192","uid":"00000000-00005840"},{"pid":1704,"ppid":7116,"name":"Start.exe","command_line":"","sha256":"2fc93c927d77d430ff3e3309b94970cdedf45706c8c765e439234ff100b32691","normalized_path":"C:\\inetpub\\PassFab iPhone Unlocker\\Start.exe","parent_uid":"00000000-00007116","uid":"00000000-00001704"}],"all_imported_dlls":["imm32.dll","propsys.dll","wldp.dll","WindowsCodecs.dll","System.Xaml.ni.dll","RegisterAndLog.dll","ws2_32.dll","virtdisk.dll","System.Windows.Interactivity.dll","cryptsp.dll","ServicingCommon.dll","wbemsvc.dll","mscoreei.dll","SecurityLaunchCLR.dll","apphelp.dll","MpOAV.dll","System.Xml.ni.dll","ThreadCore.dll","msvcrt.dll","version.dll","iertutil.dll","cfgmgr32.dll","thumbcache.dll","msvcp140.dll","ntdll.dll","wow64base.dll","msctf.dll","OneCoreUAPCommonProxyStub.dll","AppService.dll","System.ComponentModel.Composition.dll","Wldap32.dll","SoftwareLog.dll","rpcrt4.dll","oleaut32.dll","ncrypt.dll","ucrtbase_clr0400.dll","mpr.dll","sspicli.dll","comdlg32.dll","CoreMessaging.dll","tiptsf.dll","ios_manager.dll","wow64win.dll","kernel32.dll","KernelBase.dll","winsta.dll","wpfgfx_v0400.dll","ts_base.dll","msvcp_win.dll","winmm.dll","setupapi.dll","BugSplatDotNet.dll","uxtheme.dll","wininet.dll","msi.dll","FileReport.dll","samcli.dll","userenv.dll","System.ni.dll","PresentationCore.ni.dll","DWrite.dll","PresentationNative_v0400.dll","log4net.dll","ts_sqlite3.dll","ole32.dll","fltLib.dll","msftedit.dll","winhttp.dll","wmiutils.dll","win32u.dll","gdi32.dll","urlmon.dll","ntasn1.dll","Windows.UI.dll","dwmapi.dll","ntmarta.dll","Windows.Globalization.dll","ExplorerFrame.dll","sfc.dll","ntshrui.dll","mscoree.dll","IPHLPAPI.DLL","SHCore.dll","CoreUIComponents.dll","clbcatq.dll","shfolder.dll","clr.dll","vcruntime140_clr0400.dll","msvcp140_clr0400.dll","System.Configuration.ni.dll","itunes_manager.dll","Downloader.dll","user32.dll","ucrtbase.dll","srvcli.dll","psapi.dll","libcurl.dll","wow64cpu.dll","AppResolver.dll","policymanager.dll","bcrypt.dll","AgentSupportCLR.dll","RstrtMgr.dll","mscorlib.ni.dll","wow64con.dll","AcGenral.dll","shell32.dll","msimg32.dll","profapi.dll","framedynos.dll","oleacc.dll","gdi32full.dll","netutils.dll","comctl32.dll","kernel.appcore.dll","windows.storage.dll","WindowsBase.ni.dll","diasymreader.dll","VxSSL32.dll","globinputhost.dll","cscapi.dll","PresentationFramework.ni.dll","ts_client.dll","combase.dll","Windows.StateRepositoryPS.dll","sfc_os.dll","linkinfo.dll","dbghelp.dll","fastprox.dll","vcruntime140.dll","WinTypes.dll","edputil.dll","msvcp110_win.dll","amsi.dll","oledlg.dll","wtsapi32.dll","sechost.dll","shlwapi.dll","bcryptprimitives.dll","TextInputFramework.dll","cryptbase.dll","BCP47Langs.dll","System.Core.ni.dll","IosManager.dll","wow64.dll","clrjit.dll","rsaenh.dll","TextShaping.dll","wbemprox.dll","wbemcomn.dll","GdiPlus.dll","TS.UI.dll","advapi32.dll","msacm32.dll","Register.dll","h8N52ue5.dll","aepic.dll","powrprof.dll","msIso.dll","winmmbase.dll","cldapi.dll","imagehlp.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"f6e16cf7e112a4efe415a2357e4d5142bc0bc9edf322dc3c74e3706bc6071851","sha256":"f6e16cf7e112a4efe415a2357e4d5142bc0bc9edf322dc3c74e3706bc6071851","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Setup.tmp","sha256":"d8a3394398c0083b1a3a4a8ffccab7bc5946cf582e2fb22312f5b3642df06336","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-GUR4M.tmp","sha256":"38ee033b1ae499023d547532bb5c4dabdf2e7cef8db2dab0a2ef86762d47c44e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-V84VB.tmp","sha256":"6a99ef06a120238f797b3488277603fade37ed36c36278707fdef5ece32bdf07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"PassFab iPhone Unlocker.lnk","sha256":"b1ddb85162fb7ae93387b80a75ba4d48511bae0ac5c8ed53c39b054584c3198d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"Uninstall PassFab iPhone Unlocker.lnk","sha256":"7d0a7a10a5bfa8be66116957707a545ec59665d16476138c8947f4892375327b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"_setup64.tmp","sha256":"388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-RMO1P.tmp","sha256":"f2c854966337cbbca1d087524b1057049fad65ad08ccb30fa936f45e567f902c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-CD3BP.tmp","sha256":"12810b32b5ae54ffdd80c392e3762dda094af65bcc4b2e946b9e5fd9ac7ef904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-6DCI3.tmp","sha256":"ba7305a291fedc3234a4c6fc2a751df30842b619ad120687709fa2bd112b0e0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-HTLMS.tmp","sha256":"9e660848676a0fdff6b6f6ae68973fd99b670349a36ad7ebc56a319cab766839","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-F6J94.tmp","sha256":"fe47c21a5b34cc6634716835c71afbe289581b90fdb4dc45165e25fe28f67aeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-2AU7K.tmp","sha256":"87b4c300541166546dbc8d6ef71f6daf80e8e4b6b0724d6a3838bd9f709235e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-K2GG8.tmp","sha256":"ea8fc9192d60a78820da393baff637152404078202007c8a4597c1c029cd2bc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-MPTCL.tmp","sha256":"d1321ff0de3719fddc55357f0e5af6af04530f40d173d5398f9c7fa4a734bcdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-DFTH1.tmp","sha256":"995b3f4fb4634a0cadd1286d7b45d8cc9d628d8d14443056f0d2f8eef6842885","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-614M1.tmp","sha256":"3bff46313bebd0dc446e19906fee1bd1da763d7fbae8c0a30178f72e88d4e0fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-DUGR9.tmp","sha256":"a6a7f917e16619f66df619ea6ca6dab8590d697169a5e37d208fb2579270ec2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-G9VIT.tmp","sha256":"c046b7a995626a4de92329301dee8d89076c2d82108aa3a00100aade8661c58d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-53AR5.tmp","sha256":"74acfcd628e2e89ffb6f10d92d97c019e16bd1ba93b3f054b5f1a220dde2dd58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"is-4KCIR.tmp","sha256":"6a99ef06a120238f797b3488277603fade37ed36c36278707fdef5ece32bdf07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-BK10K.tmp","sha256":"38ee033b1ae499023d547532bb5c4dabdf2e7cef8db2dab0a2ef86762d47c44e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-EH25K.tmp","sha256":"f2c854966337cbbca1d087524b1057049fad65ad08ccb30fa936f45e567f902c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-51GQP.tmp","sha256":"12810b32b5ae54ffdd80c392e3762dda094af65bcc4b2e946b9e5fd9ac7ef904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-ORE7P.tmp","sha256":"ba7305a291fedc3234a4c6fc2a751df30842b619ad120687709fa2bd112b0e0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-NEDP2.tmp","sha256":"9e660848676a0fdff6b6f6ae68973fd99b670349a36ad7ebc56a319cab766839","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-QSI0P.tmp","sha256":"fe47c21a5b34cc6634716835c71afbe289581b90fdb4dc45165e25fe28f67aeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-C8FTH.tmp","sha256":"87b4c300541166546dbc8d6ef71f6daf80e8e4b6b0724d6a3838bd9f709235e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-6SOSI.tmp","sha256":"ea8fc9192d60a78820da393baff637152404078202007c8a4597c1c029cd2bc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-LKF40.tmp","sha256":"d1321ff0de3719fddc55357f0e5af6af04530f40d173d5398f9c7fa4a734bcdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-8QL6C.tmp","sha256":"995b3f4fb4634a0cadd1286d7b45d8cc9d628d8d14443056f0d2f8eef6842885","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-0DE4I.tmp","sha256":"3bff46313bebd0dc446e19906fee1bd1da763d7fbae8c0a30178f72e88d4e0fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-T8NMM.tmp","sha256":"a6a7f917e16619f66df619ea6ca6dab8590d697169a5e37d208fb2579270ec2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-C7FPI.tmp","sha256":"c046b7a995626a4de92329301dee8d89076c2d82108aa3a00100aade8661c58d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-50PH6.tmp","sha256":"74acfcd628e2e89ffb6f10d92d97c019e16bd1ba93b3f054b5f1a220dde2dd58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"is-9O4M1.tmp","sha256":"38ee033b1ae499023d547532bb5c4dabdf2e7cef8db2dab0a2ef86762d47c44e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-UH8AP.tmp","sha256":"6a99ef06a120238f797b3488277603fade37ed36c36278707fdef5ece32bdf07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"PassFab iPhone Unlocker.exe.log","sha256":"1100ed9448c3c466977a5c32d2e74e92d1c80db4cd8079014f028e48d2dc8883","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-9F2LG.tmp","sha256":"f2c854966337cbbca1d087524b1057049fad65ad08ccb30fa936f45e567f902c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-E1S74.tmp","sha256":"12810b32b5ae54ffdd80c392e3762dda094af65bcc4b2e946b9e5fd9ac7ef904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-7DJMI.tmp","sha256":"ba7305a291fedc3234a4c6fc2a751df30842b619ad120687709fa2bd112b0e0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-LC7O2.tmp","sha256":"9e660848676a0fdff6b6f6ae68973fd99b670349a36ad7ebc56a319cab766839","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-TLD4Q.tmp","sha256":"fe47c21a5b34cc6634716835c71afbe289581b90fdb4dc45165e25fe28f67aeb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-E0LUO.tmp","sha256":"87b4c300541166546dbc8d6ef71f6daf80e8e4b6b0724d6a3838bd9f709235e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-EEF3L.tmp","sha256":"ea8fc9192d60a78820da393baff637152404078202007c8a4597c1c029cd2bc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-U9MCF.tmp","sha256":"d1321ff0de3719fddc55357f0e5af6af04530f40d173d5398f9c7fa4a734bcdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-FPI9R.tmp","sha256":"995b3f4fb4634a0cadd1286d7b45d8cc9d628d8d14443056f0d2f8eef6842885","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-F8RIS.tmp","sha256":"3bff46313bebd0dc446e19906fee1bd1da763d7fbae8c0a30178f72e88d4e0fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-CJ6FA.tmp","sha256":"a6a7f917e16619f66df619ea6ca6dab8590d697169a5e37d208fb2579270ec2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-UJJ9P.tmp","sha256":"c046b7a995626a4de92329301dee8d89076c2d82108aa3a00100aade8661c58d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-S9BBA.tmp","sha256":"74acfcd628e2e89ffb6f10d92d97c019e16bd1ba93b3f054b5f1a220dde2dd58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-BU359.tmp","sha256":"9def8ca5d38541c057cb079ea62a7ce508f7cd5d601b9012cd16506812f8bb91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-O802A.tmp","sha256":"92b616861ae4f59a318a9f30170f05a45ca199b4cc088414808d2a42747fb634","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-8PCE9.tmp","sha256":"74dd52511cedb19d1fdff2eccf80f4c36c48b7335be84e7a6349cf956fb77786","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"is-I574Q.tmp","sha256":"258e814b6a82a6b11efa76a9bb63575465f27a49038cf953232bb2849e99f906","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%TEMP%\\is-NI9S7.tmp\\Setup.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%TEMP%\\is-GO4C5.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-NB28T.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\config\\is-47LI0.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-BDITL.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-G3UF9.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-FERRI.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-F98U6.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-HDL5L.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-K7GE7.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-G7N9B.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-KRQ23.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-COIK5.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-D0ATO.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-QLVQ0.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-90P4E.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-4KKAU.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-57J6K.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-UO7PA.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-LKQ00.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-53LFN.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-M495I.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-366N1.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-VMA3H.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-F4HC9.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-5IDBB.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-2KN6R.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-MP6HN.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-SLHEB.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-8F6SM.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-TIL0J.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-CNI1D.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-C7R7M.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-AQ9IB.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-8EQVV.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-QFAT9.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-FJUE1.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-6RRP3.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-5N14N.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-VT143.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-0V2R5.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-SVSHM.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-2VQIK.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-K3C8K.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-A1MCP.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-5M9GR.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-P5JHE.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-3G1HJ.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\7z\\is-GUR4M.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\7z\\is-V84VB.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-MMFCS.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-1D9PP.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-5SL8J.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-0HRPT.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-3L6KM.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-QGNFT.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-LDP29.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-2IBH9.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-N54SL.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-TMSMO.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-AROVF.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-PV8A9.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-TF6SH.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-OS152.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-M2JHU.tmp","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"C:\\inetpub","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Logs\\NetFrameCheck.log","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Logs\\2025-07-22.log","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"path":"%TEMP%\\is-IKMD1.tmp\\Setup.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"%TEMP%\\is-HTSPE.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-IDG22.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\config\\is-BUL1G.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-S0D3T.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-MI9A9.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-GRHDD.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-I49D5.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-HCMT6.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-4VE3M.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-96CJA.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-NF1DM.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-9BVEU.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-UQB7A.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-1GPSH.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-7DEES.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-MALJR.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-LK2QV.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-LDS5R.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-NJN0F.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-MLHQO.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-KJ78D.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-L0700.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-8NKM6.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-N5C6B.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-2E8TB.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-RU4FN.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-05I7P.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-H7IDC.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-EN4BI.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-2ARDP.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-1U9H1.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-AJTQK.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-67G8P.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-GKL6T.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-QE1HM.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-3V9CQ.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-HUBEP.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-883RR.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-FCCDF.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-BR7MN.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-BUAR9.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-Q881C.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-NL5C4.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-JIOV2.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-TT7G2.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-DRN08.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\is-1AEPE.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\7z\\is-BK10K.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\7z\\is-4KCIR.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-VV0L6.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-LFG55.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-KMTA5.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-S25DD.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-DBLGV.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-HCK2V.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-RGQUB.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-VCBDF.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-14COA.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-KC6AN.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-S5CK1.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-GJK4Q.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-8MA3V.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-A0HO3.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Monitor\\is-J40LT.tmp","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"C:\\inetpub\\PassFab iPhone Unlocker\\Logs\\2026-02-25.log","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"path":"%TEMP%\\is-GPS3I.tmp\\window10iphoneunlockersetup.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%TEMP%\\is-9HUPI.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-GMF3M.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\config\\is-I3PEL.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-2OGUL.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-MS1D1.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-SV2C2.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-T4ORH.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-GE9E4.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-6C559.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-6B3S9.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-D19VI.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-HHF19.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-31H01.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-4CE92.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-IVA2G.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-SVBUS.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-SDFV2.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-DJGR6.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-3HTG2.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-5RE1M.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-6JV83.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-5HLFC.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-34DO0.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-N5SOE.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-QSS4S.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-DG6MC.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-VE7E3.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-HVF5T.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-46I37.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-HCLKV.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-LVOA2.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-BA20Q.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-B98KP.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-IA03T.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-EOD7M.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-FMDJU.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-TRHFD.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-O6MFT.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-QLG6N.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\is-PERU0.tmp","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\Logs\\NetFrameCheck.log","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%PROGRAMFILES%\\(x86)\\PassFab iPhone Unlocker\\Logs\\2026-09-18.log","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\PassFab iPhone Unlocker.exe.log","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7116:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7116:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7116:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"Local\\SM0:7116:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"Local\\SM0:7116:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"SM0:7116:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"Local\\SM0:7924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\TS_Net_Frame_Check","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1192:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1192:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1192:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"SM0:1192:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"Local\\SM0:1192:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"Local\\SM0:1192:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"TS_Net_Frame_Check","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5840:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5840:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\C__inetpub_PassFab iPhone Unlocker_Logs_","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PF_PassFab iPhone Unlocker.exe","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5840:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"PF_PassFab iPhone Unlocker.exe","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"},{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Local\\SM0:5840:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"SM0:5840:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"Local\\SM0:5840:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"}]},{"name":"C__inetpub_PassFab iPhone Unlocker_Logs_","sources":[{"report_type":"sandbox","report_id":"687f867d7f68a2d2cf085638"},{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:972:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:972:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"Local\\SM0:972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"Local\\SM0:972:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"SM0:972:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8056:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"Local\\SM0:8056:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1368:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1368:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1368:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"Local\\SM0:1368:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"Local\\SM0:1368:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"SM0:1368:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8076:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8076:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"Local\\SM0:8076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"SM0:8076:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"Local\\SM0:8076:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"699e5965dcfa18c7d903ab37"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"SM0:4256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Local\\SM0:4256:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5076:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5076:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0af988","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!0a2538","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"SM0:5076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Local\\SM0:5076:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"SM0:5076:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Local\\SM0:5076:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6600:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"SM0:6600:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6780:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6780:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"SM0:6780:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Local\\SM0:6780:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:204:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:204:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:204:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:204:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Local\\SM0:204:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"SM0:204:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Local\\SM0:204:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"SM0:204:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\C__Program Files (x86)_PassFab iPhone Unlocker_Logs_","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"SM0:5048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"Local\\SM0:5048:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"C__Program Files (x86)_PassFab iPhone Unlocker_Logs_","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]},{"name":"SM0:5048:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6aade4e206bdc687740dbe67"}]}]}},"report_ids":{"sandbox_job_ids":["699e5965dcfa18c7d903ab37","687f867d7f68a2d2cf085638","6aade4e206bdc687740dbe67"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample f513d53266e4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f513d53266e4…. Threat score 100/100. 0/24 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample f513d53266e4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f513d53266e4…. Threat score 100/100. 0/24 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f513d53266e42a2e5957fd0a7e26b3e482794c52c3c361b4dc4b0eec50719970"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample f513d53266e4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f513d53266e4…. Threat score 100/100. 0/24 AV engines flagged this file. 9 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L82","11",{}]]