34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 73:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T42b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample f76a62d3f2a5… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample f76a62d3f2a5…. Threat score 70/100. 0/24 AV engines flagged this file. 1 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c"],"about":{"@type":"SoftwareApplication","name":"setup_wipe.exe","applicationCategory":["compressed","innosetup"],"identifier":"f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","additionalType":"Suspicious sample"},"threatScore":70,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":1,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T1fcd,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "SysAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperBuffW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SignalObjectAndWait"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetSearchPathMode"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardType"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "SysFreeString"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "EnumCalendarInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "sample.bin"), Found reference to API (Indicator: "SysReAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadLocale"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceW"; Source: "sample.bin")37:T2806,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005796-00000BC0-2742002749") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00002016.00000001.289686.0018C000.00000004.mdmp, 00000000-00002016.00000002.291608.0018C000.00000004.mdmp, 00000000-00002016.00000003.299035.0018C000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00002016.00000001.289686.0018C000.00000004.mdmp, 00000000-00002016.00000002.291608.0018C000.00000004.mdmp, 00000000-00002016.00000003.299035.0018C000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=" (Indicator: "SHA384"; Source: "00000000-00002016.00000001.289686.0018C000.00000004.mdmp, 00000000-00002016.00000002.291608.0018C000.00000004.mdmp, 00000000-00002016.00000003.299035.0018C000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00002016.00000001.289686.0018C000.00000004.mdmp, 00000000-00002016.00000002.291608.0018C000.00000004.mdmp, 00000000-00002016.00000003.299035.0018C000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00002016.00000001.289686.0018C000.00000004.mdmp, 00000000-00002016.00000002.291608.0018C000.00000004.mdmp, 00000000-00002016.00000003.299035.0018C000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp")38:T15a2,"setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_4DFBB099EAFD3C82E033BF92946D3CE6.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_4DFBB099EAFD3C82E033BF92946D3CE6.CRTO.PNG"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_4F6C6A95DE30B5D33A582FCCF4EACE31.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_4F6C6A95DE30B5D33A582FCCF4EACE31.CRTO.PNG"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_526D445D4C16214309F0FD2B3BE18A89.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_526D445D4C16214309F0FD2B3BE18A89.CRTO.PNG"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_55F015A0C5605702F913536AFE70CFB0.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_55F015A0C5605702F913536AFE70CFB0.CRTO.PNG"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_56B60958A20014D300CFA26A04193740.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_57B0814207B38C3AA75E7B8B2B315454.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_57B0814207B38C3AA75E7B8B2B315454.CRTO.PNG"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_5AB58375ADDE7E8E28734AE03A901D6C.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_5AB58375ADDE7E8E28734AE03A901D6C.CRTO.PNG"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_5DAAF223B01F8F3E1BD9287170826FBC.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_5DAAF223B01F8F3E1BD9287170826FBC.CRTO.PNG"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_600CBDAFC6CDC5193845C514E6CB7AD9.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_600CBDAFC6CDC5193845C514E6CB7AD9.CRTO.PNG"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_629732940F7760F8AAA366A0207E0414.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_629732940F7760F8AAA366A0207E0414.CRTO.PNG"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_6606E2CC9010D7C63BB443037AEC6333.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_71B3B392432FC3424DB6A00A49F98185.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_747875D90CF7EDD0711AE8AA44EAA69E.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_78386EC8F2845742C324A3D7D3E800FF.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_7980A6DC451AD411799833B51FA073DA.CRTO"), "setup_wipe.tmp" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP\PNPLOCKDOWNFILES\%SYSTEMDRIVE%/PROGRAM FILES (X86)/WIPE/APPLICATION/PLUGINS/500_7980A6DC451AD411799833B51FA073DA.CRTO.PNG")39:T982,"setup_wipe.exe" queried SystemProcessInformation at 00000000-00007832-00000C15-2711945690 [PID: 7832] "setup_wipe.exe" queried SystemProcessInformation at 00000000-00007832-00000C15-2711952209 [PID: 7832] "setup_wipe.exe" queried SystemProcessInformation at 00000000-00007832-00000C15-2712237866 [PID: 7832] "setup_wipe.exe" queried SystemProcessInformation at 00000000-00007832-00000C15-2712244344 [PID: 7832] "setup_wipe.exe" queried SystemProcessInformation at 00000000-00007832-00000C15-2712414529 [PID: 7832] "setup_wipe.exe" queried SystemProcessInformation at 00000000-00007832-00000C15-2712426830 [PID: 7832] "setup_wipe.exe" queried SystemProcessInformation at 00000000-00007832-00000C15-2712655219 [PID: 7832] "setup_wipe.exe" queried SystemProcessInformation at 00000000-00007832-00000C15-2712675512 [PID: 7832] "setup_wipe.tmp" queried SystemProcessInformation at 00000000-00002016-00000C15-2713552404 [PID: 2016] "setup_wipe.tmp" queried SystemProcessInformation at 00000000-00002016-00000C15-2713559062 [PID: 2016] "setup_wipe.tmp" queried SystemProcessInformation at 00000000-00002016-00000C15-2713820900 [PID: 2016] "setup_wipe.tmp" queried SystemProcessInformation at 00000000-00002016-00000C15-2713830668 [PID: 2016] "setup_wipe.tmp" queried SystemProcessInformation at 00000000-00002016-00000C15-2714839974 [PID: 2016] "setup_wipe.tmp" queried SystemProcessInformation at 00000000-00002016-00000C15-2714846672 [PID: 2016] "Wipe.exe" queried SystemProcessInformation at 00000000-00005796-00000C15-2739175942 [PID: 5796] "Wipe.exe" queried SystemProcessInformation at 00000000-00005796-00000C15-2739184829 [PID: 5796] "Wipe.exe" queried SystemProcessInformation at 00000000-00005796-00000C15-2739947898 [PID: 5796] "Wipe.exe" queried SystemProcessInformation at 00000000-00005796-00000C15-2739954750 [PID: 5796] "Wipe.exe" queried SystemProcessInformation at 00000000-00005796-00000C15-2740171792 [PID: 5796] "Wipe.exe" queried SystemProcessInformation at 00000000-00005796-00000C15-2740181046 [PID: 5796] "Wipe.exe" queried SystemProcessInformation at 00000000-00005796-00000C15-2743079574 [PID: 5796] "Wipe.exe" queried SystemProcessInformation at 00000000-00005796-00000C15-2743086275 [PID: 5796] "Wipe.exe" queried SystemProcessInformation at 00000000-00005796-00000C15-2743823072 [PID: 5796] "Wipe.exe" queried SystemProcessInformation at 00000000-00005796-00000C15-2743829627 [PID: 5796]3a:Tefb,"setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\is-N6FCS.tmp" to "%PROGRAMFILES%\(x86)\Wipe\unins000.exe" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\is-J7Q5K.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Wipe.exe" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\is-3PGUI.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Wipe.exe.config" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\is-UEFDI.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\120.png" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\is-DVEJO.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\alert.png" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\is-50KQU.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\defLogo100.png" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\is-TKF84.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\new3014.png" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\is-CE3OB.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\new4018.png" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\is-RL4GM.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\nothsel.png" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\is-N9JEL.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\processing.png" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\is-2ITPL.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\refresh.png" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\is-9DNQT.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\trash.png" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\is-831KF.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\zones-count.ini" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\FunStarts\is-UL0KF.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\de.txt" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\FunStarts\is-JS9LR.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\en.txt" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\FunStarts\is-ND52V.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\es.txt" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\FunStarts\is-0DT3Q.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\fr.txt" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\FunStarts\is-4N847.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\it.txt" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\FunStarts\is-165JH.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\ko.txt" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\FunStarts\is-Q712A.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\pl.txt" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\FunStarts\is-R4QNF.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\pt.txt" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\FunStarts\is-2CKPJ.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\ru.txt" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\FunStarts\is-9HVTD.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\zh.txt" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\Languages\is-I5BEL.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\Languages\cs.ini" "setup_wipe.tmp" renamed original file"C:\Program Files (x86)\Wipe\Application\Languages\is-B7GS7.tmp" to "%PROGRAMFILES%\(x86)\Wipe\Application\Languages\de.ini"3b:Tb7f,Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00007832-405-139-0040A9B0 Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00007832-405-319-0040C6E4 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00007832-405-319-0040C6E4 Assembly shows XOR instruction xor eax C37BCAAEh in Stream UID: 00000000-00007832-405-406-004035B3 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002016-1920-177-004AED78 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002016-1920-264-004D7EA0 Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00002016-1920-988-004AB7A0 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00002016-1920-988-004AB7A0 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002016-1920-1095-004D0184 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002016-1920-1607-0043373C Assembly shows XOR instruction xor ah 01h in Stream UID: 00000000-00002016-1920-1785-0045777E Assembly shows XOR instruction xor al byte ptr [edx] in Stream UID: 00000000-00002016-1920-2467-0042FB60 Assembly shows XOR instruction xor eax dword ptr [ecx+00h] in Stream UID: 00000000-00002016-1920-2648-00413408 Assembly shows XOR instruction xor al 41h in Stream UID: 00000000-00002016-1920-2648-00413408 Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00002016-1920-2648-00413408 Assembly shows XOR instruction xor al byte ptr [ebp-01h] in Stream UID: 00000000-00002016-1920-2697-00413820 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00002016-1920-3125-0042A9C0 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002016-1920-3201-004344E0 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002016-1920-3255-00435F64 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002016-1920-3331-0047D474 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002016-1920-3529-00458BF4 Assembly shows XOR instruction xor al byte ptr [edx+000000B8h] in Stream UID: 00000000-00002016-1920-3545-0045883C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002016-1920-3946-00472D8C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002016-1920-3974-004748D8 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002016-1920-4083-0047C574 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00002016-1920-4553-004B84FC Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002016-1920-4553-004B84FC Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002016-1920-4684-004C5230 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002016-1920-4737-004CAB94 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002016-1920-4825-004E1C6C3c:T6509,Found XOR loop in file "setup_wipe.tmp" at offset 569640; code bytes = 30d0 Found XOR loop in file "setup_wipe.tmp" at offset 1118414; code bytes = 30d0 Found XOR loop in file "setup_wipe.tmp" at offset 1121233; code bytes = 30d0 Found XOR loop in file "setup_wipe.tmp" at offset 240367; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 258085; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 260264; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 350606; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 752967; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 780838; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 808740; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 944989; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 961133; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 1083859; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 1106126; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 1130105; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 1252653; code bytes = 8030 Found XOR loop in file "setup_wipe.tmp" at offset 1254126; code bytes = 8030 Found XOR loop in file "is-J7Q5K.tmp" at offset 351062; code bytes = 30d0 Found XOR loop in file "is-J7Q5K.tmp" at offset 353881; code bytes = 30d0 Found XOR loop in file "is-J7Q5K.tmp" at offset 530230; code bytes = 30d0 Found XOR loop in file "is-J7Q5K.tmp" at offset 533049; code bytes = 30d0 Found XOR loop in file "is-J7Q5K.tmp" at offset 338774; code bytes = 8030 Found XOR loop in file "is-J7Q5K.tmp" at offset 362753; code bytes = 8030 Found XOR loop in file "is-J7Q5K.tmp" at offset 517942; code bytes = 8030 Found XOR loop in file "is-J7Q5K.tmp" at offset 541921; code bytes = 8030 Found XOR loop in file "is-J7Q5K.tmp" at offset 575277; code bytes = 8030 Found XOR loop in file "is-J7Q5K.tmp" at offset 576749; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 569640; code bytes = 30d0 Found XOR loop in file "is-N6FCS.tmp" at offset 1118414; code bytes = 30d0 Found XOR loop in file "is-N6FCS.tmp" at offset 1121233; code bytes = 30d0 Found XOR loop in file "is-N6FCS.tmp" at offset 240367; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 258085; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 260264; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 350606; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 752967; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 780838; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 808740; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 944989; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 961133; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 1083859; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 1106126; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 1130105; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 1252653; code bytes = 8030 Found XOR loop in file "is-N6FCS.tmp" at offset 1254126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 105066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 107885; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 227308; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 388146; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 415103; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 632922; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 685904; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 696356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 701332; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 747470; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 844890; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 902543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1005847; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1040944; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1135083; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1256167; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1295967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1401162; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1459294; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1566120; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1652703; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1721078; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1796618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1809027; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1905968; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2037603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2048453; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2119306; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2130040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2179040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2226923; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2374524; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2381382; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2394298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2448159; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2490243; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2501709; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2552790; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2794871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2806023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2950012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3001065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3062554; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3124520; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3142561; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3346588; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3361945; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3378092; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3483375; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3502264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3722259; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3765436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3815921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3830043; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3853303; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3855335; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3883550; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3935376; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3978500; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4217925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4362246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4477857; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4479678; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4490947; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4518241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4565713; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4578684; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4608524; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4668114; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4735104; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4737729; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4749137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4757796; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4784911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4797890; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4897228; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4924213; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5056649; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5109196; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5142447; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5149047; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5197979; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5221142; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5271627; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5285065; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5324771; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5336614; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5391296; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5447469; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5527761; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5625606; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5685300; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5755416; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5807562; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5851270; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5906453; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5938418; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 237491; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 292908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 361040; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 576844; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 589495; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 596476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 622811; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 753459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 918744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 945781; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 959397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1437509; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1523546; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1571496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1674851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1684521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1950042; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1971348; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1975165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1977801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2122819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2291181; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2407750; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2449394; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2462832; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2476430; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2552589; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2569545; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2602628; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2716775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2745027; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2900075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2971718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3233171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3278368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3357257; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3449983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3463081; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3509611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3584856; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3704902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3706195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3717576; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3719523; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3742538; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3759937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3810660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3822226; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3894554; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3966944; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4250792; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4312311; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4429682; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4432098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4433383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4457865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4519653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4585435; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4646977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4663609; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4789675; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4862678; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4939338; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4973396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5100180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5115555; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5152192; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5157686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5236621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5281999; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5543591; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5609313; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5745596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5860707; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5928527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5991293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6003873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6063630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6088864; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6097047; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6126624; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 92778; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 116757; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 235707; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 301300; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 460585; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 478644; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 527640; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 531659; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 550313; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 569046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 584006; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 638534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 647171; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 663739; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 671549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 732108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 768929; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 772357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 783969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 790088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 791474; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 814193; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 865804; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 953092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 994189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 995264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 995336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1184110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1196306; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1196326; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1197394; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1207319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1207339; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1208407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1290541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1349955; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1351789; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1391747; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1513811; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1551525; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1555151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1562019; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1603790; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1607353; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1607492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1610728; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1613066; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1623415; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1631970; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1632683; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1668030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1730123; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1778291; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1781838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1783498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1785514; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1786002; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1787068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1807801; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1909557; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1918577; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2041272; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2084977; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2261444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2313742; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2359733; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2373552; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2381485; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2485357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2519084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2712879; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2779667; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2791844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2803549; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2807690; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2825773; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2854096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2901787; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2904323; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2919138; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2966223; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2980750; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3138837; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3293249; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3318554; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3352798; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3377855; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3417502; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3455551; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3464946; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3558482; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3564689; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3667546; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3724562; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3893191; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4011767; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4085809; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4220510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4323264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4378317; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4601746; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4652684; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4689106; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4696825; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4789266; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4873014; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4893108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4905366; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4920962; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5100897; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5144935; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5152919; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5212131; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5263827; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5400015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5468585; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5512907; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5613059; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5712744; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5814514; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5855381; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5891491; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6132917; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6209061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6224533; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6229589; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6231062; code bytes = 80303d:T592,Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wipe_is1" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002016.00000000.287768.027F0000.00000004.mdmp, 00000000-00002016.00000002.291608.027F0000.00000004.mdmp, 00000000-00002016.00000003.299035.027F0000.00000004.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") file/memory contains long string with (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp")3e:T415,file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "_setup64.tmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002016-00000C2C-2714658219") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005796-00000C2C-2741498057") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005796-00000C2C-2741500987") Found reference to API "CheckTokenMembershipW" (Indicator: "CheckTokenMembership"; Source: "00000000-00005796-00000C2C-2748712030") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002016.00000002.291608.00513000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002016.00000002.291608.00513000.00000002.mdmp")3f:T103d,Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00005796-00000C2C-2748530818") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00005796-00000C2C-2748530897") Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00005796-00000C2C-2752046389") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00005796-00000C2C-2752046476") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; File: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; File: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; File: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; File: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "setup_wipe.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "setup_wipe.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "setup_wipe.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "setup_wipe.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "setup_wipe.exe") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "setup_wipe.exe") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "findwindow"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; Source: "00000000-00002016.00000000.287768.027F0000.00000004.mdmp, 00000000-00002016.00000001.289686.00401000.00000020.mdmp, 00000000-00002016.00000002.291608.027F0000.00000004.mdmp, 00000000-00002016.00000003.299035.027F0000.00000004.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00002016.00000000.287768.027F0000.00000004.mdmp, 00000000-00002016.00000001.289686.00401000.00000020.mdmp, 00000000-00002016.00000002.291608.027F0000.00000004.mdmp, 00000000-00002016.00000003.299035.027F0000.00000004.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; Source: "00000000-00002016.00000000.287768.027F0000.00000004.mdmp, 00000000-00002016.00000001.289686.00401000.00000020.mdmp, 00000000-00002016.00000002.291608.027F0000.00000004.mdmp, 00000000-00002016.00000003.299035.027F0000.00000004.mdmp")40:T3168,"setup_wipe.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007832) "setup_wipe.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000000000000000000000000000005cce64620fe1900cfe22f760000337514fe1900000000001cfe1900000000000af48c74d9cfe6460000337530e03d76590059779815410008fe190034fe190084fe1900b0e85a77f5cfe646feffffff5cfe1900aaf92f760500000030e03d76f9a83e76010000000100000009000000000000009815410078fe1900e4eb35750000000070fe1900080000000100000001000000200000005c3a4000a4fe19006b3a40009cfe1900b0f388023c6b4000016f4000b0f38802d4fe19000a994000c8fe19000d3a40001f000000bc154100b4aa40000e2e4000216140000e000000 (UID: 00000000-00007832) "setup_wipe.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000007100b48f2900b0f8190065095c771200000000000000d06c31760200000058ab7100b48f2900d0f8190065095c771200000000000000d06c3176f0b9ed7612000000e4f81900ae2e59770200000000000000d06c3176f4f81900e16c317602000000000000001cf9190068208f750200000000000000d4ae80b87092f576000000005cf91900201b9475ffffffff6cf9190058108f753c108f75a4ae80b87092f5769cb9ed76f0b9ed764cf9190048f919000d0000000d000000504111777cc84a77000000004041117768f91900e0f91900608d9275804202cdfeffffff78f91900900f8f755041117788f91900062504777cc84a775041117794f91900 (UID: 00000000-00007832) "setup_wipe.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007832) "setup_wipe.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007832) "setup_wipe.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002016) "setup_wipe.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000005ed701ca6cfe1900cfe22f760000337560fe19000000000068fe1900000000000af48c7400003375eed701ca0000337530e03d7659005977c0eb357558fe190014843475d0fe1900b0e85a7702d701cafeffffffa8fe1900aaf92f760500000030e03d76f9a83e7601000000000033750900000098155000c4fe1900e4eb357500000000bcfe19000800000001000000010000002000000048454000f0fe190057454000e8fe1900b0f38e02c4a4400001ad4000b0f38e0220ff1900861a410014ff1900f944400092000000bc1550000c35410022304000b98640000d000000 (UID: 00000000-00002016) "setup_wipe.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000000001cf6d6c0c4c6f63616c650000000000000000000000000000000000000000000000000000010000000000000000010000000300000004000000010000000000000001cf6d6c0c4c43547970650000000000000000000000000000000000000000000000000000e12f395abcfe1900bbc18f74010000000cff190094104100090400000c000000a8fe1900020000002c000000f8fe19003e304000c6524000bc15500009040000dd324100e53241000d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020ff190025165000 (UID: 00000000-00002016) "setup_wipe.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000032d701ca90fe1900cfe22f760000517684fe1900000000008cfe1900000000000af48c7492000000f4f78e020000000015001600f4f78e0259005977a4fe19001484347500005176f4f78e020af48c74fad701cae4fe19002af48c7400000000952f395a00005176904048000000517600000000f4f78e0200000000306e347500000000f4fe1900a5c38f74010000000cff190060fed2753e3040009d52400008ff1900829640008a964000c41c5000000051760000000044ff1900a43f480000005176904048004f000000 (UID: 00000000-00002016) "setup_wipe.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000500044ff190078994a000cfe1900140100000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000032d701ca90fe1900cfe22f760000517684fe1900000000008cfe1900000000000af48c7492000000f4f78e020000000015001600f4f78e0259005977a4fe19001484347500005176f4f78e020af48c74fad701cae4fe19002af48c7400000000952f395a00005176904048000000517600000000f4f78e0200000000306e347500000000f4fe1900a5c38f74010000000cff190060fed2753e3040009d52400008ff190082964000 (UID: 00000000-00002016) "setup_wipe.tmp" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000000000000000000020fd1900e6d501ca0cd3657714fe1900684f577720938000209380000000000009505777030000000000a476065157770000000048fe19007c9d8d02000000000000000000000000000000000af48c7409000000000000002074a7767c9d8d02000000000900000020938000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002016) "setup_wipe.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d58000002000000000000000000000000000000000000007ed701ca4cfe1900cfe22f760000a47640fe19000000000048fe1900000000000af48c74920000007c9d8d02000000000f001000590059772074a77660fe1900148434750000a4767c9d8d0222d701caa0fe1900a0fe19002af48c743d010000d12f395a0000a4764c814e000000a476000000007c9d8d0200000000306e34753d010000b0fe1900a5c38f7401000000c8fe19002074a7763e3040009d524000c4fe1900829640008a96400000dd3475000033750000000020ff19004b804e000000a4764c814e0001000000090000000010000000000100fffffeffff00000008000000d8210000000001000600004f (UID: 00000000-00002016) "setup_wipe.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000001900c656577710f6190000000000a878820000000000a87882000074597710f6190000000000a8788200a8f61900ec745977cc788200f4f61900000000002f7559777a6f85737800000000000000a4030000000000007a6f8573000000002e007d73c0f6190000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ff000000a1030000000000000000000000800000000000000000000000000000000000000000000000000000a4030000000000007a6f8573000000002e007d73c0f61900b0255777c2df01cabcf619008073597715020000690000007a6f8573fcf61900 (UID: 00000000-00002016) "setup_wipe.tmp" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002016) "setup_wipe.tmp" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002016) "Wipe.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000002dbefa7f0000302a38043501000078e59f6b1a000000060000000000000031e4b5f2fa7f00000000000000000000000000000000000050e39f6b1a0000000000000000000000a0e29f6b1a0000001014c6f2fa7f000000000000000000009013c6f2fa7f0000080000000000000068002d006c0031000000000000000000000000000000000031002d0031002d0060beb6f2fa7f0000230000000000000060193804350100000000000000000000103e380435010000fc870ef635010000709f3804350100005f19380435010000120000001a000000103e380435010000f385b5f2fa7f0000103e3804350100000000000000000000c9e39f6b (UID: 00000000-00005796) "Wipe.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005796) "Wipe.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005796) "Wipe.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c93856f0fa7f000080000000000000000000000000000000b0a44304350100001033b8f2fa7f00000000000000000000000002f1fa7f000000a49f6b1a000000104153f0fa7f000040d0420435010000c0a39f6b1a000000000000000000000000000000000000000100000000000000b84053f0fa7f000000000000000000000100000000000000000002f1fa7f00003b4df9effa7f0000000000000000000078a89f6b1a0000000000000000000000d02a14f1fa7f000010b37af1fa7f0000e8f852f0fa7f000010b37af1fa7f0000d02a14f1fa7f00000d000000fa7f00000d00000000000000a0f66af1fa7f0000f5870ff1fa7f0000d02a14f1 (UID: 00000000-00005796) "Wipe.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000050c9fa7f0000e000b3f2fa7f0000406b440435010000e03d94f2fa7f0000406b440435010000006d9ef2fa7f000080e3400435010000d0cc430435010000000000000000000000000000000000006c15b5f2fa7f0000010000001a000000d0b54304350100000000b3f2fa7f0000000064043501000000000000f8000000f80050c9fa7f0000000094f2fa7f0000000000000000000000000000000000007ee7b5f2fa7f000001000000a7ff00000000370435010000000000000000000038d69f6b1a000000000000000000000031e4b5f2fa7f00000000000000000000f80050c9fa7f000018db9f6b1a000000d91758c9fa7f000080d69f6b (UID: 00000000-00005796)41:T18b2,"Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000cf6d6c0c4f626a65637400000000000000000000000000000000f4f15f6e1a0000002014490635010000e4f15f6e1a0000008000000000000000000000000000000024f07fbdfa7f0000000000000000000010000000000000000000000000000000000000000000000010000000000000006f5bd1e3fa7f000020144906 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000010000a887b71e3501000000000000000000000300000000000000ffffffff00000000201449063501000038d69f6b1a0000001000000000000000a0d59f6b1a00000024f07fbdfa7f00000000000000000000100000000000000000000000000000000000fbbdfa7f000010000000000000006f5bd1e3fa7f000000000000 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000010000506a5406350100000000000000000000ffffffff00000000680e5406350100002014490635010000c0d69f6b1a000000506a540635010000030000000000000024f07fbdfa7f00000000000000000000100000000000000000000000000000000000b91e3501000010000000000000006f5bd1e3fa7f00001f000000 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000cf6d6c0c4f626a6563740000000000000000000000000000000004f19f6e1a0000002014490635010000f4f09f6e1a0000008000000000000000000000000000000024f07fbdfa7f000000000000000000001000000000000000d0199dbdfa7f0000000000000000000010000000000000006f5bd1e3fa7f000020144906 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000010000c809b81e3501000000000000000000000300000000000000ffffffff00000000201449063501000038d69f6b1a0000001000000000000000a0d59f6b1a00000024f07fbdfa7f00000000000000000000100000000000000000000000000000000000fbbdfa7f000010000000000000006f5bd1e3fa7f000000000000 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000010000506a5406350100000000000000000000ffffffff0000000088115506350100002014490635010000c0d69f6b1a000000506a540635010000030000000000000024f07fbdfa7f00000000000000000000100000000000000000000000000000000000b91e3501000010000000000000006f5bd1e3fa7f00001f000000 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000cf6d6c0c4f626a65637400000000000000000000000000000000f4ee9f6e1a0000002014490635010000e4ee9f6e1a0000008000000000000000000000000000000024f07fbdfa7f000000000000000000001000000000000000d0199dbdfa7f0000000000000000000010000000000000006f5bd1e3fa7f000020144906 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000010000506a5406350100000000000000000000ffffffff00000000204d5506350100002014490635010000c0d69f6b1a000000506a540635010000030000000000000024f07fbdfa7f00000000000000000000100000000000000000000000000000000000b91e3501000010000000000000006f5bd1e3fa7f00001f000000 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000cf6d6c0c4f626a6563740000000000000000000000000000000084ea9f6e1a000000201449063501000074ea9f6e1a0000008000000000000000000000000000000024f07fbdfa7f000000000000000000001000000000000000d0199dbdfa7f0000000000000000000010000000000000006f5bd1e3fa7f000020144906 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000010000506a5406350100000000000000000000ffffffff0000000010895506350100002014490635010000c0d69f6b1a000000506a540635010000030000000000000024f07fbdfa7f00000000000000000000100000000000000000000000000000000000b91e3501000010000000000000006f5bd1e3fa7f00001f000000 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000cf6d6c0c4f626a65637400000000000000000000000000000000f4eb9f6e1a0000002014490635010000e4eb9f6e1a0000008000000000000000000000000000000024f07fbdfa7f000000000000000000001000000000000000d0199dbdfa7f0000000000000000000010000000000000006f5bd1e3fa7f000020144906 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000010000c8d0b91e3501000000000000000000000300000000000000ffffffff00000000201449063501000038d69f6b1a0000001000000000000000a0d59f6b1a00000024f07fbdfa7f00000000000000000000100000000000000000000000000000000000fbbdfa7f000010000000000000006f5bd1e3fa7f000000000000 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000010000506a5406350100000000000000000000ffffffff0000000080d85506350100002014490635010000c0d69f6b1a000000506a540635010000030000000000000024f07fbdfa7f00000000000000000000100000000000000000000000000000000000b91e3501000010000000000000006f5bd1e3fa7f00001f000000 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000cf6d6c0c4f626a6563740000000000000000000000000000000034ed9f6e1a000000201449063501000024ed9f6e1a0000008000000000000000000000000000000024f07fbdfa7f000000000000000000001000000000000000d0199dbdfa7f0000000000000000000010000000000000006f5bd1e3fa7f000020144906 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000010000506a5406350100000000000000000000ffffffff00000000002b5606350100002014490635010000c0d69f6b1a000000506a540635010000030000000000000024f07fbdfa7f00000000000000000000100000000000000000000000000000000000bd1e3501000010000000000000006f5bd1e3fa7f00001f000000 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000007f0000ba4881e1fa7f0000605581e1fa7f0000b06783e1fa7f0000605581e1fa7f0000b06783e1fa7f0000906783e1fa7f0000d14881e1fa7f000000000000000000004461fdeffa7f0000882a001f350100000000b6f2fa7f00000100000000000000bddb96f0fa7f00000100000000000000743b81e1fa7f000078000000 (UID: 00000000-00005796) "Wipe.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000007f00000000000000000000b0a3c11e35010000183765e8fa7f00000001000000000000103765e8fa7f0000000000000000000080cb94f0fa7f0000000000000000000000010000000000009ea469eb888e0000000081e1fa7f000001000000000000003f1164e8fa7f00000000000000000000103765e8fa7f000000000000 (UID: 00000000-00005796)42:T45d,GetTickCount@kernel32.dll at 65262-1702-004011B0 GetTickCount@KERNEL32.DLL at 00000000-00007832-405-485-004030BC GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-133-004E0054 GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-1013-00480F54 GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-1015-00480F3C GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-1124-004B39E4 GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-3351-004450F8 GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-3388-00449000 GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-3711-00465670 GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-3866-0046A7CC GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-3921-00471650 GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-4753-004D9B4C GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-4815-004E7918 GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-4911-004032D4 GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-5166-004FE728 GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-7096-004E0000 GetTickCount@KERNEL32.DLL at 00000000-00002016-1920-7254-004FD71843:T614,GetVersionExW@kernel32.dll at 65262-1281-004067CC GetVersion@kernel32.dll at 65262-1289-004011A0 GetVersion@kernel32.dll at 65262-1588-004110C4 GetVersion@kernel32.dll at 65262-1592-004067C4 GetVersionExW@KERNEL32.DLL at 00000000-00007832-405-77-0040A358 GetVersion@KERNEL32.DLL at 00000000-00007832-405-85-00411000 GetVersion@KERNEL32.DLL at 00000000-00007832-405-86-0040646C GetVersion@KERNEL32.DLL at 00000000-00007832-405-370-004110C4 GetVersionExW@KERNEL32.DLL at 00000000-00002016-1920-77-0041251C GetVersion@KERNEL32.DLL at 00000000-00002016-1920-85-00501000 GetVersion@KERNEL32.DLL at 00000000-00002016-1920-86-00408DE4 GetVersion@KERNEL32.DLL at 00000000-00002016-1920-1054-004CCDB4 GetVersion@KERNEL32.DLL at 00000000-00002016-1920-1117-004B8DE4 GetVersion@KERNEL32.DLL at 00000000-00002016-1920-3433-0044DE94 GetVersion@KERNEL32.DLL at 00000000-00002016-1920-4099-0047F8AC GetVersion@KERNEL32.DLL at 00000000-00002016-1920-4104-00480084 GetVersionExW@KERNEL32.DLL at 00000000-00002016-1920-4328-004A51AC GetVersion@KERNEL32.DLL at 00000000-00002016-1920-4421-004AA7D0 GetVersion@KERNEL32.DLL at 00000000-00002016-1920-4623-004C04EC GetVersion@KERNEL32.DLL at 00000000-00002016-1920-4625-004C0654 GetVersion@KERNEL32.DLL at 00000000-00002016-1920-5178-005010C4 GetVersion@KERNEL32.DLL at 00000000-00002016-1920-5189-00501B88 GetVersionExW@KERNEL32.DLL at 00000000-00002016-1920-5201-004E83F4 GetVersionExW@KERNEL32.DLL at 00000000-00002016-1920-6793-004A9963 GetVersion@KERNEL32.DLL at 00000000-00002016-1920-6926-004C05A844:T7b3,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "setup_wipe.exe") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "setup_wipe.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "setup_wipe.exe") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "setup_wipe.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00002016.00000001.289686.00401000.00000020.mdmp")45:Ta48,Found API call GetVersion@kernel32.dll directly followed by "cmp ax, 00000600h" and "je 0041112Ah" at 65262-1588-004110C4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp edx, 05h" and "jne 0040648Bh" at 00000000-00007832-405-86-0040646C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000600h" and "je 0041112Ah" at 00000000-00007832-405-370-004110C4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp edx, 05h" and "jne 00408E03h" at 00000000-00002016-1920-86-00408DE4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 004CCE23h" at 00000000-00002016-1920-1054-004CCDB4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 004B8E1Bh" at 00000000-00002016-1920-1117-004B8DE4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 04h" and "jc 0044E0B4h" at 00000000-00002016-1920-3433-0044DE94 Found API call GetKeyboardLayout@USER32.DLL directly followed by "cmp ebx, dword ptr [00504A9Ch]" and "je 004529AEh" at 00000000-00002016-1920-3490-00452980 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 0047F907h" at 00000000-00002016-1920-4099-0047F8AC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 00480103h" at 00000000-00002016-1920-4104-00480084 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004AA8C7h" at 00000000-00002016-1920-4421-004AA7D0 Found API call GetDiskFreeSpaceW@KERNEL32.DLL directly followed by "cmp byte ptr [ebp-02h], 00h" and "je 004B0EF5h" at 00000000-00002016-1920-4478-004B0DE4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jnc 004C055Fh" at 00000000-00002016-1920-4623-004C04EC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004C06CFh" at 00000000-00002016-1920-4625-004C0654 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000600h" and "je 0050112Ah" at 00000000-00002016-1920-5178-005010C4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp al, 04h" and "setnb byte ptr [0050C0E4h]" at 00000000-00002016-1920-5189-00501B88 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004C0623h" at 00000000-00002016-1920-6926-004C05A8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp dx, 0005h" and "jne 004C042Fh" at 00000000-00002016-1920-6927-004C03A8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jne 004A919Ch" at 00000000-00002016-1920-10102-004A90F046:T1278,"Wipe.exe" queries volume information of "C:\Program Files (x86)\Wipe\Wipe.exe" at 00000000-00005796-00000C17-2742007342 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005796-00000C17-2745193581 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005796-00000C17-2745197104 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005796-00000C17-2745199461 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005796-00000C17-2745201799 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005796-00000C17-2745204797 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005796-00000C17-2745207511 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005796-00000C17-2745209869 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005796-00000C17-2745212127 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCode.ttf" at 00000000-00005796-00000C17-2745214618 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005796-00000C17-2745216850 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005796-00000C17-2745219448 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaCodeItalic.ttf" at 00000000-00005796-00000C17-2745221606 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005796-00000C17-2745224012 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005796-00000C17-2745230126 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005796-00000C17-2745232686 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005796-00000C17-2745235064 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005796-00000C17-2745237394 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005796-00000C17-2745239876 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005796-00000C17-2745242554 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005796-00000C17-2745244817 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMono.ttf" at 00000000-00005796-00000C17-2745247192 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005796-00000C17-2745249525 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005796-00000C17-2745251897 "Wipe.exe" queries volume information of "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.18.10301.0_x64__8wekyb3d8bbwe\CascadiaMonoItalic.ttf" at 00000000-00005796-00000C17-274525425847:Ta5a,"setup_wipe.exe" called "CreateDirectoryW" with parameter %TEMP%\is-N65SF.tmp (UID: 00000000-00007832) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-7MFGP.tmp (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-7MFGP.tmp\_isetup (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\Languages (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\Plugins (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\PluginsEmbed (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\Quotes (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Framework (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Framework\FunProMessages (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Framework\Interface (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Framework\Languages (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Framework\Languages-flags (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\Framework\UForms (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\x86 (UID: 00000000-00002016) "setup_wipe.tmp" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Wipe\x64 (UID: 00000000-00002016) "Wipe.exe" called "CreateDirectoryW" with parameter %APPDATA%\wipe2021 (UID: 00000000-00005796) "Wipe.exe" called "CreateDirectoryW" with parameter %APPDATA%\wipe2021\Settings (UID: 00000000-00005796) "Wipe.exe" called "CreateDirectoryW" with parameter %APPDATA%\wipe2021\Temp (UID: 00000000-00005796) "Wipe.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs\Wipe (UID: 00000000-00005796)48:T288b,"setup_wipe.exe" called "LoadLibrary" with a parameter C:\setup_wipe.ENU (UID: 00000000-00007832) "setup_wipe.exe" called "LoadLibrary" with a parameter C:\setup_wipe.EN (UID: 00000000-00007832) "setup_wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00007832) "setup_wipe.tmp" called "LoadLibrary" with a parameter %TEMP%\is-N65SF.tmp\setup_wipe.ENU (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter %TEMP%\is-N65SF.tmp\setup_wipe.EN (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\MSFTEDIT.DLL (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002016) "setup_wipe.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002016) "Wipe.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\46c2f46666e40896049aed7e4ed25573\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Runt73a1fc9d#\58ba49ba353b106be54fdada5c7b0154\System.Runtime.Remoting.ni.dl (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\6287e09015a311a64c4fe0304818f8c3\System.Management.ni.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\\wminet_utils.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Accessibility\54b5bbea0a4dec2a26f0964fd09330d6\Accessibility.ni.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter oleacc.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleacc.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UIAutomationCore.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter UIAutomationCore.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll (UID: 00000000-00005796) "Wipe.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00005796)49:T1202,"setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\is-N6FCS.tmp & %PROGRAMFILES%\(x86)\Wipe\unins000.exe (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\is-J7Q5K.tmp & %PROGRAMFILES%\(x86)\Wipe\Wipe.exe (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\is-3PGUI.tmp & %PROGRAMFILES%\(x86)\Wipe\Wipe.exe.config (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\is-UEFDI.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\120.png (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\is-DVEJO.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\alert.png (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\is-50KQU.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\defLogo100.png (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\is-TKF84.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\new3014.png (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\is-CE3OB.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\new4018.png (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\is-RL4GM.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\nothsel.png (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\is-N9JEL.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\processing.png (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\is-2ITPL.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\refresh.png (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\is-9DNQT.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\trash.png (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\is-831KF.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\zones-count.ini (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-UL0KF.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\de.txt (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-JS9LR.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\en.txt (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-ND52V.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\es.txt (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-0DT3Q.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\fr.txt (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-4N847.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\it.txt (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-165JH.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\ko.txt (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-Q712A.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\pl.txt (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-R4QNF.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\pt.txt (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-2CKPJ.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\ru.txt (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-9HVTD.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\zh.txt (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-I5BEL.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\Languages\cs.ini (UID: 00000000-00002016) "setup_wipe.tmp" called "MoveFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-B7GS7.tmp & %PROGRAMFILES%\(x86)\Wipe\Application\Languages\de.ini (UID: 00000000-00002016)4a:Tfd4a,"setup_wipe.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00007832) "setup_wipe.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007832) "setup_wipe.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter WINNLSEnableIME (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ImmGetConversionStatus (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ImmSetConversionStatus (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ImmSetOpenStatus (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ImmSetCompositionWindow (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ImmSetCompositionFontW (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter MsiQueryProductStateW (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter MonitorFromWindow (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002016) "setup_wipe.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002016) "Wipe.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetWindowLongPtr (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipCreateFontFamilyFromName (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipCreateFont (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetFontSize (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCID (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetSystemDefaultLCIDW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetObject (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipCreateFontFromLogfontW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ND_RI2 (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ND_RI2_RetAddr (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ND_RU1 (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ND_RU1_RetAddr (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetFontUnit (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetFontStyle (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetFamily (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetDpiY (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetFontHeight (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetEmHeight (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetLineSpacing (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipDeleteFont (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetLogFontW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ND_WU1 (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ND_WU1_RetAddr (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateFontIndirect (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32W (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetWindowText (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetUserObjectInformation (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetUserObjectInformationA (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetClassInfo (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DefWindowProc (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetStartupInfo (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateIconFromResourceEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SendMessage (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetWindowTextLength (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetWindowText (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RedrawWindow (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SystemParametersInfo (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetThemeAppPropertiesW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter OpenThemeDataW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CryptQueryObject (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CryptMsgGetParam (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CryptMsgClose (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CertGetNameStringW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LoadLibrary (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ResetSecurity (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetSecurity (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter BlessIWbemServices (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter BlessIWbemServicesObject (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetPropertyHandle (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter WritePropertyValue (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter Clone (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter VerifyClientKey (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetQualifierSet (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter Get (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter Put (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter Delete (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetNames (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter BeginEnumeration (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter Next (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter EndEnumeration (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetPropertyQualifierSet (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetObjectText (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SpawnDerivedClass (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SpawnInstance (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CompareTo (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetPropertyOrigin (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter InheritsFrom (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetMethod (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter PutMethod (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DeleteMethod (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter BeginMethodEnumeration (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter NextMethod (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter EndMethodEnumeration (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetMethodQualifierSet (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetMethodOrigin (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter QualifierSet_Get (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter QualifierSet_Put (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter QualifierSet_Delete (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter QualifierSet_GetNames (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter QualifierSet_BeginEnumeration (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter QualifierSet_Next (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter QualifierSet_EndEnumeration (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentApartmentType (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetDemultiplexedStub (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateInstanceEnumWmi (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateClassEnumWmi (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ExecQueryWmi (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ExecNotificationQueryWmi (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter PutInstanceWmi (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter PutClassWmi (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CloneEnumWbemClassObject (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ConnectServerWmi (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter Initialize (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RtlZeroMemory (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetPrivateProfileStringA (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegSetValueEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetFamilyName (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SaveDC (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetMapMode (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DrawTextExW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DrawTextExWW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetSysColorW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter IsThemePartDefinedW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipCreateRegion (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetClip (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipCreateMatrix (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetWorldTransform (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipIsMatrixIdentity (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetMatrixElements (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipDeleteMatrix (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipIsInfiniteRegion (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipDeleteRegion (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetDC (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter OffsetViewportOrgEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetThemePartSizeW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter RestoreDC (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipReleaseDC (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter EnumThreadWindows (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter MapWindowPoints (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetMonitorInfo (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateDC (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ExtractAssociatedIcon (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter ExtractAssociatedIconW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetIconInfo (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CopyImage (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateStdAccessibleObject (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter UiaClientsAreListening (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter UiaClientsAreListeningW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter UiaRaiseAutomationEvent (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter UiaRaiseAutomationEventW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter UiaHostProviderFromHwnd (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter UiaHostProviderFromHwndW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetNearestColor (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipCreateHalftonePalette (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SelectPalette (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipSetPageUnit (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipSaveGraphics (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipDrawRectangleI (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipDeletePen (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LoadCursor (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter LoadCursorW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetSysColorBrush (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetObjectType (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipTranslateWorldTransform (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipSetClipRectI (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipRestoreGraphics (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetRegionHRgn (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetClipRgn (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SelectClipRgn (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipGetTextRenderingHint (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetTextAlign (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetTextColor (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetBkMode (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipFillRectangleI (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DrawThemeBackgroundW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CloseThemeDataW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GdipCombineRegionRegion (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetMenu (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter GetMenuW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter IsChild (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter WritePrivateProfileStringA (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter UiaReturnRawElementProvider (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter UiaReturnRawElementProviderW (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter CLSIDFromProgIDEx (UID: 00000000-00005796) "Wipe.exe" called "GetProcAddress" with a parameter SxsLookupClrGuid (UID: 00000000-00005796)4b:T107a,"select UUID from Win32_ComputerSystemProduct" (Source: 00000000-00005796-00002714-2750639083, Indicator: "select uuid from win32_computersystemproduct") "select SerialNumber from Win32_BaseBoard" (Source: 00000000-00005796-00002714-2750833116, Indicator: "select serialnumber from win32_baseboard") "select SerialNumber from win32_bios" (Source: 00000000-00005796-00002714-2750910673, Indicator: "select serialnumber from win32_bios") "select ProcessorId from Win32_Processor" (Source: 00000000-00005796-00002714-2750985353, Indicator: "select processorid from win32_processor") "select Manufacturer from win32_bios" (Source: 00000000-00005796-00002714-2751080212, Indicator: "select manufacturer from win32_bios") "select Manufacturer from Win32_BaseBoard" (Source: 00000000-00005796-00002714-2751120021, Indicator: "select manufacturer from win32_baseboard") "select UUID from Win32_ComputerSystemProduct" (Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, Indicator: "select uuid from win32_computersystemproduct") "select SerialNumber from Win32_BaseBoard" (Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, Indicator: "select serialnumber from win32_baseboard") "select SerialNumber from win32_bios" (Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, Indicator: "select serialnumber from win32_bios") "select ProcessorId from Win32_Processor" (Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, Indicator: "select processorid from win32_processor") "select Manufacturer from win32_bios" (Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, Indicator: "select manufacturer from win32_bios") "select Manufacturer from Win32_BaseBoard" (Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, Indicator: "select manufacturer from win32_baseboard") "SELECT * FROM moz_bookmarks where fk>0fkselect * from moz_places where id>0idERROR: Delete from moz_places where id=CONTENT DELETED BY WIPEABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789BIN_EMPTYBIN_CALClogo_wipeprowipe2021https://www.privacyroot.com/software/scripts/wipe/Main\SamStats2.iniA7_SAMSTATS_GETREPORT" (Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, Indicator: "select * from moz_bookmarks where fk>0fkselect * from moz_places where id>0iderror: delete from moz_places where id=content deleted by wipeabcdefghijklmnopqrstuvwxyz0123456789bin_emptybin_calclogo_wipeprowipe2021https://www.privacyroot.com/software/scripts/wipe/main\samstats2.inia7_samstats_getreport")4c:T5ef,Sleep@kernel32.dll at 65262-1442-004011FC Sleep@kernel32.dll at 65262-1570-0040ABCC MsgWaitForMultipleObjects at 65262-1585-004068C4 WaitForSingleObject@kernel32.dll at 65262-2193-0040686A Sleep@KERNEL32.DLL at 00000000-00007832-405-224-004024EC Sleep@KERNEL32.DLL at 00000000-00007832-405-357-0040E5F4 MsgWaitForMultipleObjects at 00000000-00007832-405-366-0040EB68 Sleep@KERNEL32.DLL at 00000000-00007832-405-392-00401677 Sleep@KERNEL32.DLL at 00000000-00007832-405-397-00401C7C Sleep@KERNEL32.DLL at 00000000-00007832-405-401-004018F8 Sleep@KERNEL32.DLL at 00000000-00007832-405-682-00401E74 Sleep@KERNEL32.DLL at 00000000-00007832-405-695-0040ABCC WaitForSingleObject@KERNEL32.DLL at 00000000-00002016-1920-198-004B3FA4 WaitForSingleObject@KERNEL32.DLL at 00000000-00002016-1920-931-0047A6AC SetTimer at 00000000-00002016-1920-933-0047D408 Sleep@KERNEL32.DLL at 00000000-00002016-1920-1011-00480F20 MsgWaitForMultipleObjects at 00000000-00002016-1920-1121-004B4254 Sleep@KERNEL32.DLL at 00000000-00002016-1920-2689-0040B9D4 WaitForSingleObject@KERNEL32.DLL at 00000000-00002016-1920-2690-004139E8 Sleep@KERNEL32.DLL at 00000000-00002016-1920-2755-00402700 WaitForSingleObject@KERNEL32.DLL at 00000000-00002016-1920-3117-0042A3BC WaitForSingleObject@KERNEL32.DLL at 00000000-00002016-1920-3125-0042A9C0 MsgWaitForMultipleObjectsEx at 00000000-00002016-1920-3280-00437CE0 WaitForSingleObject@KERNEL32.DLL at 00000000-00002016-1920-3295-004382E8 SetTimer at 00000000-00002016-1920-3404-0044AB444d:T45c,LoadLibraryW@kernel32.dll at 65262-1466-004067DC LoadLibraryExW@KERNEL32.DLL at 00000000-00007832-405-36-00405DE8 LoadLibraryW@KERNEL32.DLL at 00000000-00007832-405-244-004069C8 LoadLibraryW@KERNEL32.DLL at 00000000-00007832-405-263-0040AC84 LoadLibraryExW@KERNEL32.DLL at 00000000-00002016-1920-36-00408370 LoadLibraryW@KERNEL32.DLL at 00000000-00002016-1920-319-00413CA8 LoadLibraryW@KERNEL32.DLL at 00000000-00002016-1920-1417-004AA10F LoadLibraryExW@KERNEL32.DLL at 00000000-00002016-1920-1512-004A1AC8 LoadLibraryW@KERNEL32.DLL at 00000000-00002016-1920-1758-00439644 LoadLibraryW@KERNEL32.DLL at 00000000-00002016-1920-2796-0040A348 LoadLibraryW@KERNEL32.DLL at 00000000-00002016-1920-3301-00438A30 LoadLibraryW@KERNEL32.DLL at 00000000-00002016-1920-3821-004691D0 LoadLibraryW@KERNEL32.DLL at 00000000-00002016-1920-3957-00439580 LoadLibraryW@KERNEL32.DLL at 00000000-00002016-1920-4330-004A5230 LoadLibraryW@KERNEL32.DLL at 00000000-00002016-1920-4331-004A6820 LoadLibraryW@KERNEL32.DLL at 00000000-00002016-1920-4421-004AA7D0 LoadLibraryW@KERNEL32.DLL at 00000000-00002016-1920-5196-005021384e:T4b8,Found reference to API "ShellExecuteEx failed (%d)." (Indicator: "ShellExecute"; File: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx" (Indicator: "ShellExecute"; File: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx returned hProcess=0" (Indicator: "ShellExecute"; File: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "setup_wipe.exe") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "setup_wipe.exe") Found reference to API "ShellExecuteEx failed (%d)." (Indicator: "ShellExecute"; Source: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx returned hProcess=0" (Indicator: "ShellExecute"; Source: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00005796.00000002.293261.041E2000.00000002.mdmp")4f:T900,Process setup_wipe.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7832:168:WilStaging_02" Process setup_wipe.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7832:168:WilStaging_02" Process setup_wipe.exe created mutex with name "Local\SM0:7832:168:WilStaging_02" Process setup_wipe.exe created mutex with name "SM0:7832:168:WilStaging_02" Process setup_wipe.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2016:168:WilStaging_02" Process setup_wipe.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2016:168:WilStaging_02" Process setup_wipe.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2016:64:WilError_03" Process setup_wipe.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2016:64:WilError_03" Process setup_wipe.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process setup_wipe.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process setup_wipe.tmp created mutex with name "Local\SM0:2016:168:WilStaging_02" Process setup_wipe.tmp created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process setup_wipe.tmp created mutex with name "SM0:2016:168:WilStaging_02" Process setup_wipe.tmp created mutex with name "Local\SM0:2016:64:WilError_03" Process setup_wipe.tmp created mutex with name "SM0:2016:64:WilError_03" Process setup_wipe.tmp created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process Wipe.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5796:120:WilError_03" Process Wipe.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5796:304:WilStaging_02" Process Wipe.exe created mutex with name "SM0:5796:304:WilStaging_02" Process Wipe.exe created mutex with name "SM0:5796:120:WilError_03" Process Wipe.exe created mutex with name "Local\SM0:5796:304:WilStaging_02" Process Wipe.exe created mutex with name "Local\SM0:5796:120:WilError_03" Process Wipe.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5796:304:WilStaging_02" Process Wipe.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5796:120:WilError_03"50:T896,"Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\oleacc.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UIAutomationCore.dll" - [base:0; Status:c0000135] "Wipe.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\comctl32.dll" - [base:0; Status:c0000135]51:T9d64,"\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00002016.00000000.287768.00800000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002016.00000000.287768.00800000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wipe_is1" in Source: 00000000-00002016.00000000.287768.027F0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\" in Source: 00000000-00002016.00000000.287768.027F0000.00000004.mdmp "Software\Microsoft\Input" in Source: 00000000-00002016.00000000.287768.736B1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00002016.00000000.287768.736B1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00002016.00000000.287768.736B1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00002016.00000000.287768.736B1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002016.00000001.289686.00800000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\" in Source: 00000000-00002016.00000001.289686.03EE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00002016.00000002.291608.00513000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002016.00000002.291608.00513000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002016.00000002.291608.00513000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00002016.00000002.291608.00513000.00000002.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002016.00000002.291608.00800000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wipe_is1" in Source: 00000000-00002016.00000002.291608.027F0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\" in Source: 00000000-00002016.00000002.291608.027F0000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002016.00000003.299035.00800000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wipe_is1" in Source: 00000000-00002016.00000003.299035.027F0000.00000004.mdmp "SOFTWARE\Microsoft\NET Framework Setup\NDP\" in Source: 00000000-00002016.00000003.299035.027F0000.00000004.mdmp "\Software\WOW6432Node\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00005796.00000000.289419.04370000.00000004.mdmp "INE\Software\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00005796.00000000.289419.04370000.00000004.mdmp "\Software\WOW6432Node\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00005796.00000001.291341.04370000.00000004.mdmp "INE\Software\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00005796.00000001.291341.04370000.00000004.mdmp "Use Control Panel to manage system restore points.\Settings\Checkboxes.iniCheckboxes\Settings\Settings.ini*.*RESET_IMG_CACHEOk!REM_AUTO_EXCL132VIEW_AUTO_EXCLHKEY_HKCUHKLM,DIVE,DELTOP\custom_items.txtWRITE_CUST_ITEMSDIVEWith subdirs, DELTOPWith top item, READ_CUST_ITEMSB16_CLICKB18_CLICKB19_CLICKB20_CLICK133134ShutDownON\FunStarts\\FunStarts\en.txtFUN_GET_QUOTENO_FUN_STARTS_QUOTES;FUN_RANDOMInitializing ...ERROR 7091: Failed to start cleaner. Queue is not empty.135Software\Microsoft\Windows NT\CurrentVersion\SystemRestoreSystemRestorePointCreationFrequencySYS_REST_OPENwinmgmts:{impersonationLevel=impersonate}!root/default:SystemRestoreBefore cleanup by CreateRestorePointSYS_REST_CREATERESTORE POINT ERROR:" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp "136137138139shutdown-s -t 05 -c " "SHUTDOWNB4_CLICK-1,alist,chkBY-DEFAULTB5_CLICKASKWARN140CHECKBOX_CHECKED_STATUS_CHANGEDREFRESH_IMG_MAIN_CLICKTRASH_IMG_MAIN_CLICKTRASH_CLICKB11_CLICKISNEW_1%ProgramFiles%ISNEW_2%ProgramFiles(x86)%ISNEW_3\PackagesISNEW_4Software\Microsoft\Windows\CurrentVersion\UninstallISNEW_5SOFTWARE\Microsoft\Windows\CurrentVersion\UninstallISNEW_6\found_apps.pathsREAD_FOUND_APPS141*.crtoMissing plugin files, reinstall applicationDETECT_AGAINFoundAppTitles.crto\tempD.tmpREAD_DECR_PLUGINREAD_TEXT_PLUGIN142>143SAVE_FOUND_APPS144DETECT=CHECK_CUSTOM_ITEMS_FILEUAPP|%localappdata%\Packages\HKHKEY_CURRENT_USERHKEY_LOCAL_MACHINEDETECTOR_REG_1DETECTOR_REG_2WIPE_LOAD_ALL_DATA_1197CLOSE=,VAR1=VAR2=VAR3=VAR4=ADDFILE=\WIPE_LOAD_ALL_DATA_2\tempE.tmpLOAD_ALL_DATA_1LOAD_ALL_DATA_1BSEPARATOR=DESCRIPTION=ASK=EXCLUDE=Not selected by defaultMust be adminProfessional onlyWarn that most users dont need itCUTTEXT|SQL|JSON|REG|FS|SPECIAL|%VAR1%%VAR2%%VAR3%%VAR4%%program%pf2%systemroot%ACTIONADMINEXCLUDELOAD_ALL_DATA_0LOAD_ALL_DATA_5LOAD_ALL_DATA_2AutoDeselectRecentCheckLOAD_ALL_DATA_3145AUTO_DESEL_CHK_BACKapp-titlearea-info1146area-info2147area-listviewApplicationCheckboxDays unusedarea-button1148area-button3+ 14 daysarea-button2149parentDIRECTCAST_B1AUTODIS_B2This will extend check period from to days. Are you sure?DC_B3_CLICKSENDER_CLOSEIS1IS2AdministratorsUsersSETPERMISSIONSCOUNT_INSTANCES150Closing app ...FAIL_2CLOSE_APPAPP_EXISTS_VERIFI151IS_CHECKBOX_CHECKEDFIX_MISSING_ITEMS%documents%%desktop%*POSSIBLE_PATH_1%locallow%%appdata%\..\LocalLow%packages%%localappdata%\Packages%pf2%%programfiles%%programfiles(x86)%{0:### ### ### ### ### ### ### ###}COOL_NUMBER_SbbytesKbMbGbTbCOOL_NUMBER_FtrashSWITCH_IMGON_ICONLISTxdefLogo100.pngP_SAVE_2CACHECONVERT2GRAYSCALE152153154155156157158159160161163162164 table in db SQL TABLE: 210211165; 166167168169170Special script SCRIPT NAME: \StatsBytes.txt\StatsDates.txtGI_STATS_LOADALL_2_QUEUETURN_OFF_PROCESSING_IMGTURN_OFF_NOTH180181 (185)184183182187lengthStartsWithalertCTYPE+ALIST_GARCTYPE_ALIST_CHKCTYPE_ALIST_TRASHCTYPE_ALIST_TRACKSNA188189190191192193194DELETED OK: FAILED TO DELETE: - [Too big value to print]ERROR GETTING INFO: : ERROR DELETING: SUPERPERMFOLDER: ERROR GETTING FILE SIZE FOR ERROR: [ bytes]" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp "Version Updates"" uf_sub_winStartupSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunDEL_APP_REGSoftware\Microsoft\Windows\CurrentVersion\RunGET_APP_REGHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunSET_APP_REG\RegFix .reg\\\"Windows Registry Editor Version 5.00[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"="REGFIX_CREATIONREG_APP_DEL2SetupDIRAllUsers.lnkRUNONSETIPSetupHUpdateDelete settings and statistics?Running search for untranslated pairs..." in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "IS THIS A U-FRAMEWORK PROJECT?AppFrameworkAppOnly lines for translation. Files for translation on your DESKTOP! TO FLD uf_sub_callServer winStartupSetupEXESetupSizeSetupVersion?scn=&version=&pcid=&location=&iso2=&iso2ui=&lang_uframework-web.pl-empty-%username%-error-'pcid' => '' 'scn' => ''ul' => ''version' => ''comments4admin' => ''username' => ''iso2' => 'Windows XPWindows VistaWindows 7Windows 8Windows 8.1Windows 10Windows 11Windows 12'os' => ''booboo' => ''errorsandwarnings' => ''errormessages' => ''samstats2' => ''fromo' => 'CALLING_SERVERERROR #SA1: uframework-pc.plCALL_SERVER_STARTERROR #SA2: CALL_SERVER_PROGRESSERROR #SA3: Timeout/cancelled.ERROR #SA9: ERROR #SA4: [OK]ERROR #SA5: Invalid server response\Settings\ServerResponse.iniActivation-KeyActivation-OrderIDActivation-OrderTimeActivation-OrderYearsOpenThisUrlSOFTWARE\Microsoft\Windows NT\CurrentVersionCSDVersionReleaseIdos~sp~diskformat~size~fixreadydisks~diskSystem~SystemDrive%SystemDrive%\usersAll UsersDefaultDefault UserPublicusercount~primaryscreen~monitors~is64~ramTotal~timezone~iso2~iso2ui~dpi~GETDPIculture~[^A-Za-z0-9 ()]\unhandledErrorReport.ini%appdata%\..\..\..afterErrorERROR-INFOMessageStackTracePCIDSCNVERSIONTIMEERROR-SSSSOTHERINFOx509length: |IsAdmin: uframework-errors.plON_FORMSmessageIN_THREADSUFramework_TopMPanelUFramework_TopULineUFramework_TopAppLogoUFramework_TopTitleTextSIV_FIRM_TEXT_ON_BACKGROUNDSIV_FORM_BORDERUFramework_Top_CloseButton\Interface\ui_closeButton_flat.pngUFramework_Top_MinimizeButton\Interface\ui_minButton_flat.pngUFramework_Top_MenuButton\Interface\ui_menuButton_flat.png\Interface\ui_closeButton_hover.png\Interface\ui_minButton_hover.pngpro1\UForms\pro_menu.pngpro2manualupdatesubscribecontact\Languages-flags\clanguageabout62\Interface\ui_menuButton_hover.pngPrivacyRoot IFGTitleDate of releaseVersionOkayUF_AboutPictureBox1actlink to buylink to supportA keyTo convert free version of the program to Professional and unlock all functions please enter your activation key below.Panel2cancel linkkey remindergo backbuy a new keyHere goes the info from server of any kindUF_Activation\UForms\activationkeys.pngserror converting to local formatActivationResponseActDo[ANOTHERPC][ANOTHERAPP][REFUND][EXPIRED][INVALID][THISORDERID][^0-9-]reminderuframework-other.pl?a=resetactivation&key=&scn=SubscriptionActivationOffer PROUpdateUntranslated?LanguageAboutManual UpdateAutomatic translationYes!UF_LanguageFormUF_LanguageUF_ManualUpdate" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "Software\Microsoft\.NETFramework" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManag" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowFullDomainLiterals" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp, "Software\Classes\AppID\Wipe.exe" in Source: 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, "hine\Software\ClassQ" in Source: 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, "\Software\WOW6432Node\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00005796.00000002.293261.04370000.00000004.mdmp, "INE\Software\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00005796.00000002.293261.04370000.00000004.mdmp, "Use Control Panel to manage system restore points.\Settings\Checkboxes.iniCheckboxes\Settings\Settings.ini*.*RESET_IMG_CACHEOk!REM_AUTO_EXCL132VIEW_AUTO_EXCLHKEY_HKCUHKLM DIVE DELTOP\custom_items.txtWRITE_CUST_ITEMSDIVEWith subdirs DELTOPWith top item READ_CUST_ITEMSB16_CLICKB18_CLICKB19_CLICKB20_CLICK133134ShutDownON\FunStarts\\FunStarts\en.txtFUN_GET_QUOTENO_FUN_STARTS_QUOTES;FUN_RANDOMInitializing ...ERROR 7091: Failed to start cleaner. Queue is not empty.135Software\Microsoft\Windows NT\CurrentVersion\SystemRestoreSystemRestorePointCreationFrequencySYS_REST_OPENwinmgmts:{impersonationLevel=impersonate}!root/default:SystemRestoreBefore cleanup by CreateRestorePointSYS_REST_CREATERESTORE POINT ERROR:" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp, "136137138139shutdown-s -t 05 -c " "SHUTDOWNB4_CLICK-1 alist chkBY-DEFAULTB5_CLICKASKWARN140CHECKBOX_CHECKED_STATUS_CHANGEDREFRESH_IMG_MAIN_CLICKTRASH_IMG_MAIN_CLICKTRASH_CLICKB11_CLICKISNEW_1%ProgramFiles%ISNEW_2%ProgramFiles(x86)%ISNEW_3\PackagesISNEW_4Software\Microsoft\Windows\CurrentVersion\UninstallISNEW_5SOFTWARE\Microsoft\Windows\CurrentVersion\UninstallISNEW_6\found_apps.pathsREAD_FOUND_APPS141*.crtoMissing plugin files reinstall applicationDETECT_AGAINFoundAppTitles.crto\tempD.tmpREAD_DECR_PLUGINREAD_TEXT_PLUGIN142>143SAVE_FOUND_APPS144DETECT=CHECK_CUSTOM_ITEMS_FILEUAPP|%localappdata%\Packages\HKHKEY_CURRENT_USERHKEY_LOCAL_MACHINEDETECTOR_REG_1DETECTOR_REG_2WIPE_LOAD_ALL_DATA_1197CLOSE= VAR1=VAR2=VAR3=VAR4=ADDFILE=\WIPE_LOAD_ALL_DATA_2\tempE.tmpLOAD_ALL_DATA_1LOAD_ALL_DATA_1BSEPARATOR=DESCRIPTION=ASK=EXCLUDE=Not selected by defaultMust be adminProfessional onlyWarn that most users dont need itCUTTEXT|SQL|JSON|REG|FS|SPECIAL|%VAR1%%VAR2%%VAR3%%VAR4%%program%pf2%systemroot%ACTIONADMINEXCLUDELOAD_ALL_DATA_0LOAD_ALL_DATA_5LOAD_ALL_DATA_2AutoDeselectRecentCheckLOAD_ALL_DATA_3145AUTO_DESEL_CHK_BACKapp-titlearea-info1146area-info2147area-listviewApplicationCheckboxDays unusedarea-button1148area-button3+ 14 daysarea-button2149parentDIRECTCAST_B1AUTODIS_B2This will extend check period from to days. Are you sure?DC_B3_CLICKSENDER_CLOSEIS1IS2AdministratorsUsersSETPERMISSIONSCOUNT_INSTANCES150Closing app ...FAIL_2CLOSE_APPAPP_EXISTS_VERIFI151IS_CHECKBOX_CHECKEDFIX_MISSING_ITEMS%documents%%desktop%*POSSIBLE_PATH_1%locallow%%appdata%\..\LocalLow%packages%%localappdata%\Packages%pf2%%programfiles%%programfiles(x86)%{0:### ### ### ### ### ### ### ###}COOL_NUMBER_SbbytesKbMbGbTbCOOL_NUMBER_FtrashSWITCH_IMGON_ICONLISTxdefLogo100.pngP_SAVE_2CACHECONVERT2GRAYSCALE152153154155156157158159160161163162164 table in db SQL TABLE: 210211165; 166167168169170Special script SCRIPT NAME: \StatsBytes.txt\StatsDates.txtGI_STATS_LOADALL_2_QUEUETURN_OFF_PROCESSING_IMGTURN_OFF_NOTH180181 (185)184183182187lengthStartsWithalertCTYPE+ALIST_GARCTYPE_ALIST_CHKCTYPE_ALIST_TRASHCTYPE_ALIST_TRACKSNA188189190191192193194DELETED OK: FAILED TO DELETE: - [Too big value to print]ERROR GETTING INFO: : ERROR DELETING: SUPERPERMFOLDER: ERROR GETTING FILE SIZE FOR ERROR: [ bytes]" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp, "Version Updates"" uf_sub_winStartupSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunDEL_APP_REGSoftware\Microsoft\Windows\CurrentVersion\RunGET_APP_REGHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunSET_APP_REG\RegFix .reg\\\"Windows Registry Editor Version 5.00[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"="REGFIX_CREATIONREG_APP_DEL2SetupDIRAllUsers.lnkRUNONSETIPSetupHUpdateDelete settings and statistics?Running search for untranslated pairs..." in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "IS THIS A U-FRAMEWORK PROJECT?AppFrameworkAppOnly lines for translation. Files for translation on your DESKTOP! TO FLD uf_sub_callServer winStartupSetupEXESetupSizeSetupVersion?scn=&version=&pcid=&location=&iso2=&iso2ui=&lang_uframework-web.pl-empty-%username%-error-'pcid' => '','scn' => ''ul' => ''version' => ''comments4admin' => ''username' => ''iso2' => 'Windows XPWindows VistaWindows 7Windows 8Windows 8.1Windows 10Windows 11Windows 12'os' => ''booboo' => ''errorsandwarnings' => ''errormessages' => ''samstats2' => ''fromo' => 'CALLING_SERVERERROR #SA1: uframework-pc.plCALL_SERVER_STARTERROR #SA2: CALL_SERVER_PROGRESSERROR #SA3: Timeout/cancelled.ERROR #SA9: ERROR #SA4: [OK]ERROR #SA5: Invalid server response\Settings\ServerResponse.iniActivation-KeyActivation-OrderIDActivation-OrderTimeActivation-OrderYearsOpenThisUrlSOFTWARE\Microsoft\Windows NT\CurrentVersionCSDVersionReleaseIdos~sp~diskformat~size~fixreadydisks~diskSystem~SystemDrive%SystemDrive%\usersAll UsersDefaultDefault UserPublicusercount~primaryscreen~monitors~is64~ramTotal~timezone~iso2~iso2ui~dpi~GETDPIculture~[^A-Za-z0-9 ()]\unhandledErrorReport.ini%appdata%\..\..\..afterErrorERROR-INFOMessageStackTracePCIDSCNVERSIONTIMEERROR-SSSSOTHERINFOx509length: |IsAdmin: uframework-errors.plON_FORMSmessageIN_THREADSUFramework_TopMPanelUFramework_TopULineUFramework_TopAppLogoUFramework_TopTitleTextSIV_FIRM_TEXT_ON_BACKGROUNDSIV_FORM_BORDERUFramework_Top_CloseButton\Interface\ui_closeButton_flat.pngUFramework_Top_MinimizeButton\Interface\ui_minButton_flat.pngUFramework_Top_MenuButton\Interface\ui_menuButton_flat.png\Interface\ui_closeButton_hover.png\Interface\ui_minButton_hover.pngpro1\UForms\pro_menu.pngpro2manualupdatesubscribecontact\Languages-flags\clanguageabout62\Interface\ui_menuButton_hover.pngPrivacyRoot IFGTitleDate of releaseVersionOkayUF_AboutPictureBox1actlink to buylink to supportA keyTo convert free version of the program to Professional and unlock all functions please enter your activation key below.Panel2cancel linkkey remindergo backbuy a new keyHere goes the info from server of any kindUF_Activation\UForms\activationkeys.pngserror converting to local formatActivationResponseActDo[ANOTHERPC][ANOTHERAPP][REFUND][EXPIRED][INVALID][THISORDERID][^0-9-]reminderuframework-other.pl?a=resetactivation&key=&scn=SubscriptionActivationOffer PROUpdateUntranslated?LanguageAboutManual UpdateAutomatic translationYes!UF_LanguageFormUF_LanguageUF_ManualUpdate" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManag" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowFullDomainLiterals" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005796.00000002.293261.06490000.00000004.mdmp "Software\Classes\AppID\Wipe.exe" in Source: 00000000-00005796.00000002.293261.1EB50000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000002.293261.1EB50000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp "hine\Software\ClassQ" in Source: 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00005796.00000002.293261.E2043000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00005796.00000002.293261.E2043000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00005796.00000002.293261.E2043000.00000002.mdmp "\Software\WOW6432Node\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00005796.00000003.299067.04370000.00000004.mdmp "INE\Software\Microsoft\StrongName\RevokedKeys" in Source: 00000000-00005796.00000003.299067.04370000.00000004.mdmp "Use Control Panel to manage system restore points.\Settings\Checkboxes.iniCheckboxes\Settings\Settings.ini*.*RESET_IMG_CACHEOk!REM_AUTO_EXCL132VIEW_AUTO_EXCLHKEY_HKCUHKLM,DIVE,DELTOP\custom_items.txtWRITE_CUST_ITEMSDIVEWith subdirs, DELTOPWith top item, READ_CUST_ITEMSB16_CLICKB18_CLICKB19_CLICKB20_CLICK133134ShutDownON\FunStarts\\FunStarts\en.txtFUN_GET_QUOTENO_FUN_STARTS_QUOTES;FUN_RANDOMInitializing ...ERROR 7091: Failed to start cleaner. Queue is not empty.135Software\Microsoft\Windows NT\CurrentVersion\SystemRestoreSystemRestorePointCreationFrequencySYS_REST_OPENwinmgmts:{impersonationLevel=impersonate}!root/default:SystemRestoreBefore cleanup by CreateRestorePointSYS_REST_CREATERESTORE POINT ERROR:" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp "136137138139shutdown-s -t 05 -c " "SHUTDOWNB4_CLICK-1,alist,chkBY-DEFAULTB5_CLICKASKWARN140CHECKBOX_CHECKED_STATUS_CHANGEDREFRESH_IMG_MAIN_CLICKTRASH_IMG_MAIN_CLICKTRASH_CLICKB11_CLICKISNEW_1%ProgramFiles%ISNEW_2%ProgramFiles(x86)%ISNEW_3\PackagesISNEW_4Software\Microsoft\Windows\CurrentVersion\UninstallISNEW_5SOFTWARE\Microsoft\Windows\CurrentVersion\UninstallISNEW_6\found_apps.pathsREAD_FOUND_APPS141*.crtoMissing plugin files, reinstall applicationDETECT_AGAINFoundAppTitles.crto\tempD.tmpREAD_DECR_PLUGINREAD_TEXT_PLUGIN142>143SAVE_FOUND_APPS144DETECT=CHECK_CUSTOM_ITEMS_FILEUAPP|%localappdata%\Packages\HKHKEY_CURRENT_USERHKEY_LOCAL_MACHINEDETECTOR_REG_1DETECTOR_REG_2WIPE_LOAD_ALL_DATA_1197CLOSE=,VAR1=VAR2=VAR3=VAR4=ADDFILE=\WIPE_LOAD_ALL_DATA_2\tempE.tmpLOAD_ALL_DATA_1LOAD_ALL_DATA_1BSEPARATOR=DESCRIPTION=ASK=EXCLUDE=Not selected by defaultMust be adminProfessional onlyWarn that most users dont need itCUTTEXT|SQL|JSON|REG|FS|SPECIAL|%VAR1%%VAR2%%VAR3%%VAR4%%program%pf2%systemroot%ACTIONADMINEXCLUDELOAD_ALL_DATA_0LOAD_ALL_DATA_5LOAD_ALL_DATA_2AutoDeselectRecentCheckLOAD_ALL_DATA_3145AUTO_DESEL_CHK_BACKapp-titlearea-info1146area-info2147area-listviewApplicationCheckboxDays unusedarea-button1148area-button3+ 14 daysarea-button2149parentDIRECTCAST_B1AUTODIS_B2This will extend check period from to days. Are you sure?DC_B3_CLICKSENDER_CLOSEIS1IS2AdministratorsUsersSETPERMISSIONSCOUNT_INSTANCES150Closing app ...FAIL_2CLOSE_APPAPP_EXISTS_VERIFI151IS_CHECKBOX_CHECKEDFIX_MISSING_ITEMS%documents%%desktop%*POSSIBLE_PATH_1%locallow%%appdata%\..\LocalLow%packages%%localappdata%\Packages%pf2%%programfiles%%programfiles(x86)%{0:### ### ### ### ### ### ### ###}COOL_NUMBER_SbbytesKbMbGbTbCOOL_NUMBER_FtrashSWITCH_IMGON_ICONLISTxdefLogo100.pngP_SAVE_2CACHECONVERT2GRAYSCALE152153154155156157158159160161163162164 table in db SQL TABLE: 210211165; 166167168169170Special script SCRIPT NAME: \StatsBytes.txt\StatsDates.txtGI_STATS_LOADALL_2_QUEUETURN_OFF_PROCESSING_IMGTURN_OFF_NOTH180181 (185)184183182187lengthStartsWithalertCTYPE+ALIST_GARCTYPE_ALIST_CHKCTYPE_ALIST_TRASHCTYPE_ALIST_TRACKSNA188189190191192193194DELETED OK: FAILED TO DELETE: - [Too big value to print]ERROR GETTING INFO: : ERROR DELETING: SUPERPERMFOLDER: ERROR GETTING FILE SIZE FOR ERROR: [ bytes]" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp "Version Updates"" uf_sub_winStartupSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunDEL_APP_REGSoftware\Microsoft\Windows\CurrentVersion\RunGET_APP_REGHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunSET_APP_REG\RegFix .reg\\\"Windows Registry Editor Version 5.00[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"="REGFIX_CREATIONREG_APP_DEL2SetupDIRAllUsers.lnkRUNONSETIPSetupHUpdateDelete settings and statistics?Running search for untranslated pairs..." in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "IS THIS A U-FRAMEWORK PROJECT?AppFrameworkAppOnly lines for translation. Files for translation on your DESKTOP! TO FLD uf_sub_callServer winStartupSetupEXESetupSizeSetupVersion?scn=&version=&pcid=&location=&iso2=&iso2ui=&lang_uframework-web.pl-empty-%username%-error-'pcid' => '' 'scn' => ''ul' => ''version' => ''comments4admin' => ''username' => ''iso2' => 'Windows XPWindows VistaWindows 7Windows 8Windows 8.1Windows 10Windows 11Windows 12'os' => ''booboo' => ''errorsandwarnings' => ''errormessages' => ''samstats2' => ''fromo' => 'CALLING_SERVERERROR #SA1: uframework-pc.plCALL_SERVER_STARTERROR #SA2: CALL_SERVER_PROGRESSERROR #SA3: Timeout/cancelled.ERROR #SA9: ERROR #SA4: [OK]ERROR #SA5: Invalid server response\Settings\ServerResponse.iniActivation-KeyActivation-OrderIDActivation-OrderTimeActivation-OrderYearsOpenThisUrlSOFTWARE\Microsoft\Windows NT\CurrentVersionCSDVersionReleaseIdos~sp~diskformat~size~fixreadydisks~diskSystem~SystemDrive%SystemDrive%\usersAll UsersDefaultDefault UserPublicusercount~primaryscreen~monitors~is64~ramTotal~timezone~iso2~iso2ui~dpi~GETDPIculture~[^A-Za-z0-9 ()]\unhandledErrorReport.ini%appdata%\..\..\..afterErrorERROR-INFOMessageStackTracePCIDSCNVERSIONTIMEERROR-SSSSOTHERINFOx509length: |IsAdmin: uframework-errors.plON_FORMSmessageIN_THREADSUFramework_TopMPanelUFramework_TopULineUFramework_TopAppLogoUFramework_TopTitleTextSIV_FIRM_TEXT_ON_BACKGROUNDSIV_FORM_BORDERUFramework_Top_CloseButton\Interface\ui_closeButton_flat.pngUFramework_Top_MinimizeButton\Interface\ui_minButton_flat.pngUFramework_Top_MenuButton\Interface\ui_menuButton_flat.png\Interface\ui_closeButton_hover.png\Interface\ui_minButton_hover.pngpro1\UForms\pro_menu.pngpro2manualupdatesubscribecontact\Languages-flags\clanguageabout62\Interface\ui_menuButton_hover.pngPrivacyRoot IFGTitleDate of releaseVersionOkayUF_AboutPictureBox1actlink to buylink to supportA keyTo convert free version of the program to Professional and unlock all functions please enter your activation key below.Panel2cancel linkkey remindergo backbuy a new keyHere goes the info from server of any kindUF_Activation\UForms\activationkeys.pngserror converting to local formatActivationResponseActDo[ANOTHERPC][ANOTHERAPP][REFUND][EXPIRED][INVALID][THISORDERID][^0-9-]reminderuframework-other.pl?a=resetactivation&key=&scn=SubscriptionActivationOffer PROUpdateUntranslated?LanguageAboutManual UpdateAutomatic translationYes!UF_LanguageFormUF_LanguageUF_ManualUpdate" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\XML" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "Software\Microsoft\.NETFramework" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManag" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.AllowFullDomainLiterals" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SystemDefaultTlsVersions" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00005796.00000003.299067.06490000.00000004.mdmp, "Software\Classes\AppID\Wipe.exe" in Source: 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, "S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-1271187874-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, "y\Machine\Software\Classes\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{00000346-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}" in Source: 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{00021401-0000-0000-C000-000000000046}" in Source: 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, "Registry\Machine\Software\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}" in Source: 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005796.00000003.299067.5E2F0000.00000004.mdmp, "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00005796.00000003.299067.5E2F0000.00000004.mdmp, "Software\Borland\Locales" in Source: 00000000-00007832.00000000.287665.00401000.00000020.mdmp, "Software\Borland\Delphi\Locales" in Source: 00000000-00007832.00000000.287665.00401000.00000020.mdmp, "SOFTWARE\Microsoft\NET Framework Setup\NDP\" in Source: 00000000-00007832.00000003.299008.02790000.00000004.mdmp52:T2910,"setup_wipe.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74790000 "setup_wipe.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76eb0000 "setup_wipe.exe" loaded module "COMCTL32.DLL" at base 74fb0000 "setup_wipe.exe" loaded module "KERNEL32.DLL" at base 75330000 "setup_wipe.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74a30000 "setup_wipe.exe" loaded module "NTDLL.DLL" at base 77530000 "setup_wipe.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74930000 "setup_wipe.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74790000 "setup_wipe.tmp" loaded module "IMM32.DLL" at base 75c90000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74a30000 "setup_wipe.tmp" loaded module "KERNEL32.DLL" at base 75330000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76eb0000 "setup_wipe.tmp" loaded module "RPCRT4.DLL" at base 75f40000 "setup_wipe.tmp" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76460000 "setup_wipe.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76bf0000 "setup_wipe.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76bf0000 "setup_wipe.tmp" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 76a40000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76510000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76870000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73b50000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 73b10000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 759e0000 "setup_wipe.tmp" loaded module "MSI.DLL" at base 737d0000 "setup_wipe.tmp" loaded module "COMCTL32" at base 74fb0000 "setup_wipe.tmp" loaded module "UXTHEME.DLL" at base 74a30000 "setup_wipe.tmp" loaded module "COMCTL32.DLL" at base 74fb0000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 76180000 "setup_wipe.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 736b0000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\MSFTEDIT.DLL" at base 733f0000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.GLOBALIZATION.DLL" at base 732a0000 "setup_wipe.tmp" loaded module "USER32.DLL" at base 76bf0000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 73110000 "setup_wipe.tmp" loaded module "DWMAPI.DLL" at base 730e0000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 730e0000 "setup_wipe.tmp" loaded module "SSPICLI.DLL" at base 730b0000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 72ed0000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 66680000 "setup_wipe.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 761e0000 "setup_wipe.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 761e0000 "setup_wipe.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 761e0000 "setup_wipe.tmp" loaded module "KERNEL32" at base 75330000 "setup_wipe.tmp" loaded module "API-MS-WIN-CORE-REGISTRY-L1-1-0.DLL" at base 761e0000 "setup_wipe.tmp" loaded module "NTDLL.DLL" at base 77530000 "setup_wipe.tmp" loaded module "KERNELBASE" at base 761e0000 "setup_wipe.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74930000 "Wipe.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffabe2d0000 "Wipe.exe" loaded module "ADVAPI32.DLL" at base 13504640000 "Wipe.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffaeff50000 "Wipe.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffaeff50000 "Wipe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffaeff50000 "Wipe.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffabe230000 "Wipe.exe" loaded module "SHLWAPI.DLL" at base 7ffaf1830000 "Wipe.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffaeefa0000 "Wipe.exe" loaded module "VERSION.DLL" at base 7ffae6930000 "Wipe.exe" loaded module "KERNEL32" at base 7ffaf1ea0000 "Wipe.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffabd880000 "Wipe.exe" loaded module "USER32.DLL" at base 7ffaf2940000 "Wipe.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffaeff50000 "Wipe.exe" loaded module "MSCOREE.DLL" at base 7ffac45b0000 "Wipe.exe" loaded module "NTDLL" at base 7ffaf2b30000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffaf2100000 "Wipe.exe" loaded module "PSAPI.DLL" at base 7ffaf1db0000 "Wipe.exe" loaded module "RPCRT4.DLL" at base 7ffaf0f00000 "Wipe.exe" loaded module "KERNEL32.DLL" at base 7ffaf1ea0000 "Wipe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\3B9003E4F27D92E40668F0EFAD11E022\MSCORLIB.NI.DLL" at base 7ffabc1f0000 "Wipe.exe" loaded module "OLE32.DLL" at base 7ffaf1890000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffaed580000 "Wipe.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffaf2100000 "Wipe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\CE0FD4F5B50BAA17E7B80E4EE874AD11\SYSTEM.NI.DLL" at base 7ffabb5d0000 "Wipe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\990501E6199819806F01C8ECAC88BAAC\SYSTEM.CORE.NI.DLL" at base 7ffabab40000 "Wipe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.V9921E851#\46C2F46666E40896049AED7E4ED25573\MICROSOFT.VISUALBASIC.NI.DLL" at base 7ffaba910000 "Wipe.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffaeff50000 "Wipe.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffaba7e0000 "Wipe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DRAWING\3C82A5286B5172D5A68C8DF2E09C4C40\SYSTEM.DRAWING.NI.DLL" at base 7ffaba5e0000 "Wipe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.WINDOWS.FORMS\BEE998043EB1E9BADECD282A79540A5E\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 7ffab94f0000 "Wipe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\2A25B59872A72DA9B55F952AB1B0BC8B\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffab93b0000 "Wipe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\F0078C8C05B31633E5966C5629E65602\SYSTEM.XML.NI.DLL" at base 7ffab8b00000 "Wipe.exe" loaded module "NTDLL.DLL" at base 7ffaf2b30000 "Wipe.exe" loaded module "SHELL32.DLL" at base 7ffaf1020000 "Wipe.exe" loaded module "BCRYPT.DLL" at base 7ffaef830000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffaeef10000 "Wipe.exe" loaded module "IMM32.DLL" at base 7ffaf0ec0000 "Wipe.exe" loaded module "COMCTL32.DLL" at base 7ffac9500000 "Wipe.exe" loaded module "GDI32.DLL" at base 7ffaf0b00000 "Wipe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.RUNT73A1FC9D#\58BA49BA353B106BE54FDADA5C7B0154\SYSTEM.RUNTIME.REMOTING.NI.DLL" at base 7ffab8a10000 "Wipe.exe" loaded module "UXTHEME.DLL" at base 7ffaed580000 "Wipe.exe" loaded module "GDIPLUS.DLL" at base 7ffadbfe0000 "Wipe.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_57FA636ACE18905C\GDIPLUS.DLL" at base 7ffadbfe0000 "Wipe.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffaeff50000 "Wipe.exe" loaded module "CRYPT32.DLL" at base 7ffaf03a0000 "Wipe.exe" loaded module "WINTRUST.DLL" at base 7ffaf0300000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffaf03a0000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffaf0630000 "Wipe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\6287E09015A311A64C4FE0304818F8C3\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffab88a0000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffae2590000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffae3610000 "Wipe.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\\WMINET_UTILS.DLL" at base 7ffae3d10000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffae3080000 "Wipe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffaeff50000 "Wipe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffaeff50000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffae2950000 "Wipe.exe" loaded module "AMSI.DLL" at base 7ffae2090000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffae6930000 "Wipe.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ffae2010000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\T9MBWM7F.DLL" at base 7ffad10a0000 "Wipe.exe" loaded module "OLEAUT32.DLL" at base 13504800000 "Wipe.exe" loaded module "COMCTL32.DLL" at base 7ffada540000 "Wipe.exe" loaded module "COMCTL32" at base 7ffada540000 "Wipe.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\ACCESSIBILITY\54B5BBEA0A4DEC2A26F0964FD09330D6\ACCESSIBILITY.NI.DLL" at base 7ffad47e0000 "Wipe.exe" loaded module "OLEACC.DLL" at base 7ffad5e00000 "Wipe.exe" loaded module "UIAUTOMATIONCORE.DLL" at base 7ffad2d00000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 13504800000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ffaf0da0000 "Wipe.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 7ffaf0cf0000 "Wipe.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffaf2940000 "Wipe.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffaf2940000 "Wipe.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 13504640000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffaf1890000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\UIAUTOMATIONCORE.DLL" at base 7ffad2d00000 "Wipe.exe" loaded module "SXS.DLL" at base 7ffaefcd0000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7ffae8640000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffaedf50000 "Wipe.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffae9ac0000 "Wipe.exe" loaded module "CSCAPI.DLL" at base 7ffadfc7000053:T892,"setup_wipe.tmp" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "setup_wipe.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "setup_wipe.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "setup_wipe.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "setup_wipe.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "setup_wipe.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "Wipe.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "Wipe.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "Wipe.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "Wipe.exe" touched "PSOAInterface" (Path: "HKCU\CLSID\{00020424-0000-0000-C000-000000000046}\TREATAS") "Wipe.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "Wipe.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "Wipe.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "Wipe.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "Wipe.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "Wipe.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "Wipe.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")54:T815,"setup_wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "setup_wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "setup_wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "setup_wipe.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "setup_wipe.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "setup_wipe.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CS-CZ") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CS-CZ") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DA-DK") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DA-DK") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EL-GR") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EL-GR") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES_TRADNL") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES_TRADNL") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FI-FI") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FI-FI") "Wipe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-FR")55:Tf56,Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00007832-00000C2B-2712623783] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002016-00000C2B-2714182151] Observed system executable string:"%WINDIR%\system32\shfolder.dll" [Source: 00000000-00002016-00000C2B-2714754311] Observed system executable string:"%WINDIR%\system32\Rstrtmgr.dll" [Source: 00000000-00002016-00000C2B-2714803934] Observed system executable string:"%WINDIR%\system32\shlwapi.dll" [Source: 00000000-00002016-00000C2B-2715217024] Observed system executable string:"%WINDIR%\system32\MSFTEDIT.DLL" [Source: 00000000-00002016-00000C2B-2715405802] Observed system executable string:"%WINDIR%\system32\sfc.dll" [Source: 00000000-00002016-00000C2B-2731765196] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00005796-00000C2B-2740628182] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005796-00000C2B-2741186487] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00005796-00000C2B-2741342081] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00005796-00000C2B-2741505075] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\3b9003e4f27d92e40668f0efad11e022\mscorlib.ni.dll" [Source: 00000000-00005796-00000C2B-2741957896] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00005796-00000C2B-2742008185] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00005796-00000C2B-2742095588] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\ce0fd4f5b50baa17e7b80e4ee874ad11\System.ni.dll" [Source: 00000000-00005796-00000C2B-2742227482] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\990501e6199819806f01c8ecac88baac\System.Core.ni.dll" [Source: 00000000-00005796-00000C2B-2742284893] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\46c2f46666e40896049aed7e4ed25573\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00005796-00000C2B-2742373428] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll" [Source: 00000000-00005796-00000C2B-2742478250] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Drawing\3c82a5286b5172d5a68c8df2e09c4c40\System.Drawing.ni.dll" [Source: 00000000-00005796-00000C2B-2742517838] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\bee998043eb1e9badecd282a79540a5e\System.Windows.Forms.ni.dll" [Source: 00000000-00005796-00000C2B-2742565380] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\2a25b59872a72da9b55f952ab1b0bc8b\System.Configuration.ni.dll" [Source: 00000000-00005796-00000C2B-2742783869] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\f0078c8c05b31633e5966c5629e65602\System.Xml.ni.dll" [Source: 00000000-00005796-00000C2B-2742875045] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00005796-00000C2B-2743261674] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00005796-00000C2B-2744892114] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00005796-00000C2B-2748593343]56:T7d60,"setup_wipe.tmp" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections"- Location: [%TEMP%\is-N65SF.tmp\setup_wipe.tmp]- [targetUID: 00000000-00002016] "is-J7Q5K.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 Mono/.Net assembly 2 sections"- Location: [%PROGRAMFILES%\(x86)\Wipe\is-J7Q5K.tmp]- [targetUID: 00000000-00002016] "is-T6S1P.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-T6S1P.tmp]- [targetUID: 00000000-00002016] "is-N7OI7.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-N7OI7.tmp]- [targetUID: 00000000-00002016] "is-B7GS7.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-B7GS7.tmp]- [targetUID: 00000000-00002016] "is-K1EIQ.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-K1EIQ.tmp]- [targetUID: 00000000-00002016] "is-NA1FV.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-NA1FV.tmp]- [targetUID: 00000000-00002016] "is-BTN4O.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-BTN4O.tmp]- [targetUID: 00000000-00002016] "is-QBFD2.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-QBFD2.tmp]- [targetUID: 00000000-00002016] "is-A5GPD.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-A5GPD.tmp]- [targetUID: 00000000-00002016] "is-I5BEL.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-I5BEL.tmp]- [targetUID: 00000000-00002016] "is-5OEKB.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-5OEKB.tmp]- [targetUID: 00000000-00002016] "is-LMHMH.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-LMHMH.tmp]- [targetUID: 00000000-00002016] "is-JP9R2.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JP9R2.tmp]- [targetUID: 00000000-00002016] "is-RB2LR.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-RB2LR.tmp]- [targetUID: 00000000-00002016] "is-4LLSM.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4LLSM.tmp]- [targetUID: 00000000-00002016] "is-BFS76.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BFS76.tmp]- [targetUID: 00000000-00002016] "is-6O0SS.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-6O0SS.tmp]- [targetUID: 00000000-00002016] "is-3BA22.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-3BA22.tmp]- [targetUID: 00000000-00002016] "is-UEFDI.tmp" has type "PNG image data 120 x 120 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\is-UEFDI.tmp]- [targetUID: 00000000-00002016] "is-G4SIA.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-G4SIA.tmp]- [targetUID: 00000000-00002016] "is-O4I1D.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-O4I1D.tmp]- [targetUID: 00000000-00002016] "is-931LS.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-931LS.tmp]- [targetUID: 00000000-00002016] "is-4GISE.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4GISE.tmp]- [targetUID: 00000000-00002016] "is-3I6RC.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-3I6RC.tmp]- [targetUID: 00000000-00002016] "is-IMI89.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IMI89.tmp]- [targetUID: 00000000-00002016] "is-5JS01.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-5JS01.tmp]- [targetUID: 00000000-00002016] "is-DB3IM.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-DB3IM.tmp]- [targetUID: 00000000-00002016] "is-K981T.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-K981T.tmp]- [targetUID: 00000000-00002016] "is-RCOO8.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-RCOO8.tmp]- [targetUID: 00000000-00002016] "is-0H37S.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-0H37S.tmp]- [targetUID: 00000000-00002016] "is-5TNAA.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-5TNAA.tmp]- [targetUID: 00000000-00002016] "is-EDSHH.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-EDSHH.tmp]- [targetUID: 00000000-00002016] "is-1P09O.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-1P09O.tmp]- [targetUID: 00000000-00002016] "is-P9BAD.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-P9BAD.tmp]- [targetUID: 00000000-00002016] "is-5QFMT.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-5QFMT.tmp]- [targetUID: 00000000-00002016] "is-MTITL.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-MTITL.tmp]- [targetUID: 00000000-00002016] "is-5QJR3.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-5QJR3.tmp]- [targetUID: 00000000-00002016] "is-ENH17.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-ENH17.tmp]- [targetUID: 00000000-00002016] "is-QT0RN.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-QT0RN.tmp]- [targetUID: 00000000-00002016] "is-K6VOC.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-K6VOC.tmp]- [targetUID: 00000000-00002016] "is-2M7V4.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-2M7V4.tmp]- [targetUID: 00000000-00002016] "is-23HAI.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-23HAI.tmp]- [targetUID: 00000000-00002016] "is-5NT1N.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- [targetUID: 00000000-00002016] "is-4ON0V.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4ON0V.tmp]- [targetUID: 00000000-00002016] "is-BN8EA.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BN8EA.tmp]- [targetUID: 00000000-00002016] "is-UPRSF.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-UPRSF.tmp]- [targetUID: 00000000-00002016] "is-L7DT7.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-L7DT7.tmp]- [targetUID: 00000000-00002016] "is-BU8LF.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BU8LF.tmp]- [targetUID: 00000000-00002016] "is-9MV2A.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-9MV2A.tmp]- [targetUID: 00000000-00002016] "is-MJEHT.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-MJEHT.tmp]- [targetUID: 00000000-00002016] "is-DQBP8.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-DQBP8.tmp]- [targetUID: 00000000-00002016] "is-UJ30R.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-UJ30R.tmp]- [targetUID: 00000000-00002016] "is-9I9OD.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-9I9OD.tmp]- [targetUID: 00000000-00002016] "is-NCNTG.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NCNTG.tmp]- [targetUID: 00000000-00002016] "is-DBRPL.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-DBRPL.tmp]- [targetUID: 00000000-00002016] "is-O7G9K.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-O7G9K.tmp]- [targetUID: 00000000-00002016] "is-IOG2N.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IOG2N.tmp]- [targetUID: 00000000-00002016] "is-50KQU.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\is-50KQU.tmp]- [targetUID: 00000000-00002016] "is-QUEHA.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-QUEHA.tmp]- [targetUID: 00000000-00002016] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-7MFGP.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002016] "is-NHNFO.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NHNFO.tmp]- [targetUID: 00000000-00002016] "is-0MSNP.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-0MSNP.tmp]- [targetUID: 00000000-00002016] "is-CF6J1.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-CF6J1.tmp]- [targetUID: 00000000-00002016] "is-J7A5B.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-J7A5B.tmp]- [targetUID: 00000000-00002016] "is-7T02D.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-7T02D.tmp]- [targetUID: 00000000-00002016] "is-1Q9BU.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-1Q9BU.tmp]- [targetUID: 00000000-00002016] "is-R8GJ0.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-R8GJ0.tmp]- [targetUID: 00000000-00002016] "is-QG5UG.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-QG5UG.tmp]- [targetUID: 00000000-00002016] "is-ULG52.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-ULG52.tmp]- [targetUID: 00000000-00002016] "is-K15QD.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-K15QD.tmp]- [targetUID: 00000000-00002016] "is-R13M7.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-R13M7.tmp]- [targetUID: 00000000-00002016] "is-H5OP3.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-H5OP3.tmp]- [targetUID: 00000000-00002016] "is-6OVAS.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-6OVAS.tmp]- [targetUID: 00000000-00002016] "is-VH5O4.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-VH5O4.tmp]- [targetUID: 00000000-00002016] "is-JLA1Q.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JLA1Q.tmp]- [targetUID: 00000000-00002016] "is-6K57O.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-6K57O.tmp]- [targetUID: 00000000-00002016] "is-IVLNU.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IVLNU.tmp]- [targetUID: 00000000-00002016] "is-V16GF.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-V16GF.tmp]- [targetUID: 00000000-00002016] "is-KBPV5.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-KBPV5.tmp]- [targetUID: 00000000-00002016] "is-8LS50.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-8LS50.tmp]- [targetUID: 00000000-00002016] "is-JBRLP.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JBRLP.tmp]- [targetUID: 00000000-00002016] "is-TI38C.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-TI38C.tmp]- [targetUID: 00000000-00002016] "is-9NMG4.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-9NMG4.tmp]- [targetUID: 00000000-00002016] "is-JURRI.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JURRI.tmp]- [targetUID: 00000000-00002016] "is-NI0B6.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NI0B6.tmp]- [targetUID: 00000000-00002016] "is-Q712A.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-Q712A.tmp]- [targetUID: 00000000-00002016] "is-V22M1.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-V22M1.tmp]- [targetUID: 00000000-00002016] "is-CITK8.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-CITK8.tmp]- [targetUID: 00000000-00002016] "is-9L8O5.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-9L8O5.tmp]- [targetUID: 00000000-00002016] "is-B4QL1.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-B4QL1.tmp]- [targetUID: 00000000-00002016] "is-2CKPJ.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-2CKPJ.tmp]- [targetUID: 00000000-00002016] "is-CE3OB.tmp" has type "PNG image data 40 x 18 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\is-CE3OB.tmp]- [targetUID: 00000000-00002016] "is-34ER0.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-34ER0.tmp]- [targetUID: 00000000-00002016] "is-7FSIL.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-7FSIL.tmp]- [targetUID: 00000000-00002016] "is-SQEOO.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-SQEOO.tmp]- [targetUID: 00000000-00002016] "is-UVSQH.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-UVSQH.tmp]- [targetUID: 00000000-00002016] "is-3PGUI.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\is-3PGUI.tmp]- [targetUID: 00000000-00002016] "is-LJIPB.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- [targetUID: 00000000-00002016] "is-165JH.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-165JH.tmp]- [targetUID: 00000000-00002016] "is-DVEJO.tmp" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\is-DVEJO.tmp]- [targetUID: 00000000-00002016] "is-0DT3Q.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-0DT3Q.tmp]- [targetUID: 00000000-00002016] "is-4N847.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-4N847.tmp]- [targetUID: 00000000-00002016] "is-UL0KF.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-UL0KF.tmp]- [targetUID: 00000000-00002016] "is-ND52V.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-ND52V.tmp]- [targetUID: 00000000-00002016] "is-JS9LR.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-JS9LR.tmp]- [targetUID: 00000000-00002016] "is-R4QNF.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-R4QNF.tmp]- [targetUID: 00000000-00002016] "is-RL4GM.tmp" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\is-RL4GM.tmp]- [targetUID: 00000000-00002016] "is-N9JEL.tmp" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\is-N9JEL.tmp]- [targetUID: 00000000-00002016] "is-2J4DE.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-2J4DE.tmp]- [targetUID: 00000000-00002016] "is-TKF84.tmp" has type "PNG image data 30 x 14 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\is-TKF84.tmp]- [targetUID: 00000000-00002016] "is-8V579.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-8V579.tmp]- [targetUID: 00000000-00002016] "is-2ITPL.tmp" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\is-2ITPL.tmp]- [targetUID: 00000000-00002016] "is-4J4SA.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4J4SA.tmp]- [targetUID: 00000000-00002016] "is-9DNQT.tmp" has type "PNG image data 16 x 16 8-bit colormap non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\is-9DNQT.tmp]- [targetUID: 00000000-00002016] "is-NEJLO.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NEJLO.tmp]- [targetUID: 00000000-00002016] "is-JL7Q9.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JL7Q9.tmp]- [targetUID: 00000000-00002016] "is-M63II.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-M63II.tmp]- [targetUID: 00000000-00002016] "is-SR81M.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-SR81M.tmp]- [targetUID: 00000000-00002016] "is-GVF5S.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-GVF5S.tmp]- [targetUID: 00000000-00002016] "is-9HVTD.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\FunStarts\is-9HVTD.tmp]- [targetUID: 00000000-00002016] "is-JPV1O.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JPV1O.tmp]- [targetUID: 00000000-00002016] "is-3OA5C.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-3OA5C.tmp]- [targetUID: 00000000-00002016] "is-S0VET.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-S0VET.tmp]- [targetUID: 00000000-00002016] "is-OILBQ.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-OILBQ.tmp]- [targetUID: 00000000-00002016] "is-8BSLL.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-8BSLL.tmp]- [targetUID: 00000000-00002016] "is-NF315.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NF315.tmp]- [targetUID: 00000000-00002016] "is-E384O.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-E384O.tmp]- [targetUID: 00000000-00002016] "is-TBJA6.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-TBJA6.tmp]- [targetUID: 00000000-00002016] "is-QIGKJ.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-QIGKJ.tmp]- [targetUID: 00000000-00002016] "is-2PTMA.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-2PTMA.tmp]- [targetUID: 00000000-00002016] "is-4H4IT.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4H4IT.tmp]- [targetUID: 00000000-00002016] "is-GUA43.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-GUA43.tmp]- [targetUID: 00000000-00002016] "is-TS482.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-TS482.tmp]- [targetUID: 00000000-00002016] "is-VEL0T.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-VEL0T.tmp]- [targetUID: 00000000-00002016] "is-O0C2S.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-O0C2S.tmp]- [targetUID: 00000000-00002016] "is-6NCLT.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-6NCLT.tmp]- [targetUID: 00000000-00002016] "is-CB7N1.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-CB7N1.tmp]- [targetUID: 00000000-00002016] "is-TLAVE.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-TLAVE.tmp]- [targetUID: 00000000-00002016] "is-UBBOM.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-UBBOM.tmp]- [targetUID: 00000000-00002016] "is-21BN7.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-21BN7.tmp]- [targetUID: 00000000-00002016] "is-497B2.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-497B2.tmp]- [targetUID: 00000000-00002016] "is-P5SEC.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-P5SEC.tmp]- [targetUID: 00000000-00002016] "is-T7JO9.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-T7JO9.tmp]- [targetUID: 00000000-00002016] "is-LC8P8.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-LC8P8.tmp]- [targetUID: 00000000-00002016] "is-FRFIM.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-FRFIM.tmp]- [targetUID: 00000000-00002016] "is-F25L4.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-F25L4.tmp]- [targetUID: 00000000-00002016] "is-O4DJV.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-O4DJV.tmp]- [targetUID: 00000000-00002016] "is-IBUSI.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IBUSI.tmp]- [targetUID: 00000000-00002016] "is-TRFGT.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-TRFGT.tmp]- [targetUID: 00000000-00002016] "is-PHP7Q.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-PHP7Q.tmp]- [targetUID: 00000000-00002016] "is-PUTAU.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-PUTAU.tmp]- [targetUID: 00000000-00002016] "is-JVDPA.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JVDPA.tmp]- [targetUID: 00000000-00002016] "is-K3MK1.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-K3MK1.tmp]- [targetUID: 00000000-00002016] "is-425B9.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-425B9.tmp]- [targetUID: 00000000-00002016] "is-BTH5S.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BTH5S.tmp]- [targetUID: 00000000-00002016] "is-163L5.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-163L5.tmp]- [targetUID: 00000000-00002016] "is-RU8H9.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-RU8H9.tmp]- [targetUID: 00000000-00002016] "is-QQMDP.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-QQMDP.tmp]- [targetUID: 00000000-00002016] "is-F6PDP.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-F6PDP.tmp]- [targetUID: 00000000-00002016] "is-BT85U.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BT85U.tmp]- [targetUID: 00000000-00002016] "is-T85Q6.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-T85Q6.tmp]- [targetUID: 00000000-00002016] "is-74RG5.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-74RG5.tmp]- [targetUID: 00000000-00002016] "is-1SIIM.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-1SIIM.tmp]- [targetUID: 00000000-00002016] "is-DVSJ2.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-DVSJ2.tmp]- [targetUID: 00000000-00002016] "is-S6U6N.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-S6U6N.tmp]- [targetUID: 00000000-00002016] "is-978J1.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-978J1.tmp]- [targetUID: 00000000-00002016] "is-7VPNF.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-7VPNF.tmp]- [targetUID: 00000000-00002016] "is-71J01.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-71J01.tmp]- [targetUID: 00000000-00002016] "is-ECSGJ.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-ECSGJ.tmp]- [targetUID: 00000000-00002016] "is-82EFH.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-82EFH.tmp]- [targetUID: 00000000-00002016] "is-8O7O8.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-8O7O8.tmp]- [targetUID: 00000000-00002016] "is-N05ST.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-N05ST.tmp]- [targetUID: 00000000-00002016] "is-VHNJS.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-VHNJS.tmp]- [targetUID: 00000000-00002016] "is-IIPFG.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IIPFG.tmp]- [targetUID: 00000000-00002016] "is-0T78O.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-0T78O.tmp]- [targetUID: 00000000-00002016] "is-B6T4P.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-B6T4P.tmp]- [targetUID: 00000000-00002016] "is-BUP3G.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BUP3G.tmp]- [targetUID: 00000000-00002016] "is-N7FT7.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-N7FT7.tmp]- [targetUID: 00000000-00002016] "is-B6IQ4.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-B6IQ4.tmp]- [targetUID: 00000000-00002016] "is-BHLP8.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BHLP8.tmp]- [targetUID: 00000000-00002016] "is-JEDPS.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JEDPS.tmp]- [targetUID: 00000000-00002016] "is-88LEM.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-88LEM.tmp]- [targetUID: 00000000-00002016] "is-FHQCG.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-FHQCG.tmp]- [targetUID: 00000000-00002016] "is-7T5FQ.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-7T5FQ.tmp]- [targetUID: 00000000-00002016] "is-7A2OS.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-7A2OS.tmp]- [targetUID: 00000000-00002016] "is-MMPC8.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-MMPC8.tmp]- [targetUID: 00000000-00002016] "is-VJAP7.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-VJAP7.tmp]- [targetUID: 00000000-00002016] "is-P0230.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-P0230.tmp]- [targetUID: 00000000-00002016] "is-NEP89.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NEP89.tmp]- [targetUID: 00000000-00002016] "is-9CUFS.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-9CUFS.tmp]- [targetUID: 00000000-00002016] "is-GM78P.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-GM78P.tmp]- [targetUID: 00000000-00002016] "is-IO4LI.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IO4LI.tmp]- [targetUID: 00000000-00002016] "is-DPUBG.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-DPUBG.tmp]- [targetUID: 00000000-00002016] "is-FS9D1.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-FS9D1.tmp]- [targetUID: 00000000-00002016] "is-S5DT1.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-S5DT1.tmp]- [targetUID: 00000000-00002016] "is-OBD9U.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-OBD9U.tmp]- [targetUID: 00000000-00002016] "is-HDRNA.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-HDRNA.tmp]- [targetUID: 00000000-00002016] "is-831KF.tmp" has type "Unknown"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\is-831KF.tmp]- [targetUID: 00000000-00002016] "is-N6FCS.tmp" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections"- Location: [%PROGRAMFILES%\(x86)\Wipe\is-N6FCS.tmp]- [targetUID: 00000000-00002016] "is-0GENP.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced"- Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-0GENP.tmp]- [targetUID: 00000000-00002016]57:Td69,"setup_wipe.tmp" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections" - Location: [%TEMP%\is-N65SF.tmp\setup_wipe.tmp] "is-J7Q5K.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 Mono/.Net assembly 2 sections" - Location: [%PROGRAMFILES%\(x86)\Wipe\is-J7Q5K.tmp] "is-T6S1P.tmp" has type "Unknown" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-T6S1P.tmp] "is-N7OI7.tmp" has type "Unknown" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-N7OI7.tmp] "is-B7GS7.tmp" has type "Unknown" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-B7GS7.tmp] "is-K1EIQ.tmp" has type "Unknown" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-K1EIQ.tmp] "is-NA1FV.tmp" has type "Unknown" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-NA1FV.tmp] "is-BTN4O.tmp" has type "Unknown" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-BTN4O.tmp] "is-QBFD2.tmp" has type "Unknown" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-QBFD2.tmp] "is-A5GPD.tmp" has type "Unknown" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-A5GPD.tmp] "is-I5BEL.tmp" has type "Unknown" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-I5BEL.tmp] "is-5OEKB.tmp" has type "Unknown" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Languages\is-5OEKB.tmp] "is-LMHMH.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-LMHMH.tmp] "is-JP9R2.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JP9R2.tmp] "is-RB2LR.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-RB2LR.tmp] "is-4LLSM.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4LLSM.tmp] "is-BFS76.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BFS76.tmp] "is-6O0SS.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-6O0SS.tmp] "is-3BA22.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-3BA22.tmp] "is-UEFDI.tmp" has type "PNG image data 120 x 120 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\is-UEFDI.tmp] "is-G4SIA.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-G4SIA.tmp] "is-O4I1D.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-O4I1D.tmp] "is-931LS.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-931LS.tmp] "is-4GISE.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4GISE.tmp] "is-3I6RC.tmp" has type "PNG image data 100 x 100 8-bit/color RGBA non-interlaced" - Location: [%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-3I6RC.tmp]58:T4c2,"setup_wipe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "setup_wipe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "setup_wipe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "setup_wipe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "setup_wipe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "setup_wipe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "setup_wipe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "setup_wipe.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "setup_wipe.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "setup_wipe.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")59:Ta3d,"setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "SETUP_WIPE.EXE"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "1AFF6089-E863-4D36-BDFD-3581F07440BE"; Value: "")5a:T537,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Able to identify sandbox environment running process Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: The input sample contains the RDTSCP instruction Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to query volume size Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to detect virtual environment (API)5b:T48f,"setup_wipe.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "setup_wipe.exe" trying to touch file "C:\setup_wipe.exe.Local\" "setup_wipe.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "setup_wipe.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22621.1635_none_6ebca75c88023f94\comctl32.dll" "setup_wipe.exe" trying to touch file "C:\WINDOWS\SysWOW64\ole32.dll" "setup_wipe.exe" trying to touch file "C:\Windows\SysWOW64\ole32.dll" "setup_wipe.exe" trying to touch file "C:\WINDOWS\SysWOW64\IMM32.DLL" "setup_wipe.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "setup_wipe.exe" trying to touch file "C:\Windows\WindowsShell.Manifest" "setup_wipe.exe" trying to touch file "C:\windows\temp\VxSSL32.dll" "setup_wipe.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "setup_wipe.exe" trying to touch file "C:\MSVCP140.dll" "setup_wipe.exe" trying to touch file "C:\WINDOWS\SysWOW64\MSVCP140.dll" "setup_wipe.exe" trying to touch file "C:\Windows\SysWOW64\msvcp140.dll"5c:T8a2,"setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\unins000.dat" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\is-N6FCS.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\is-J7Q5K.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\is-3PGUI.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\is-UEFDI.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\is-DVEJO.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\is-50KQU.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\is-TKF84.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\is-CE3OB.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\is-RL4GM.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\is-N9JEL.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\is-2ITPL.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\is-9DNQT.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\is-831KF.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\FunStarts\is-UL0KF.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\FunStarts\is-JS9LR.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\FunStarts\is-ND52V.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\FunStarts\is-0DT3Q.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\FunStarts\is-4N847.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\FunStarts\is-165JH.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\FunStarts\is-Q712A.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\FunStarts\is-R4QNF.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\FunStarts\is-2CKPJ.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\FunStarts\is-9HVTD.tmp" "setup_wipe.tmp" touched file "C:\Program Files (x86)\Wipe\Application\Languages\is-I5BEL.tmp"5d:T969,"setup_wipe.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "setup_wipe.exe" trying to access non-existent file "C:\MSVCP140.dll" "setup_wipe.exe" trying to access non-existent file "C:\FLTLIB.DLL" "setup_wipe.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "setup_wipe.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "setup_wipe.exe" trying to access non-existent file "C:\setup_wipe.ENU.DLL" "setup_wipe.exe" trying to access non-existent file "C:\setup_wipe.EN.DLL" "setup_wipe.tmp" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\msimg32.dll" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\version.dll" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\mpr.dll" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\FLTLIB.DLL" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\MSVCP140.dll" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\VCRUNTIME140.dll" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\CRYPTSP.DLL" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\setup_wipe.ENU.DLL" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\setup_wipe.EN.DLL" "setup_wipe.tmp" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "setup_wipe.tmp" trying to access non-existent file "C:\Program Files (x86)\Wipe\unins000.exe" "setup_wipe.tmp" trying to access non-existent file "C:\Program Files (x86)\Wipe\Wipe.exe" "Wipe.exe" trying to access non-existent file "C:\Program Files (x86)\Wipe\FLTLIB.DLL" "Wipe.exe" trying to access non-existent file "C:\Program Files (x86)\Wipe\MSVCP140.dll" "Wipe.exe" trying to access non-existent file "C:\Program Files (x86)\Wipe\VCRUNTIME140.dll" "Wipe.exe" trying to access non-existent file "C:\Program Files (x86)\Wipe\VCRUNTIME140_1.dll" "Wipe.exe" trying to access non-existent file "C:\Program Files (x86)\Wipe\CRYPTSP.DLL"5e:T6fd,"setup_wipe.exe" trying to access non-existent file "C:\setup_wipe.exe.Local\" "setup_wipe.exe" trying to access non-existent file "C:\setup_wipe.ENU" "setup_wipe.exe" trying to access non-existent file "C:\setup_wipe.EN" "setup_wipe.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "setup_wipe.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-US\netmsg.dll.mui" "setup_wipe.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\setup_wipe.tmp.Local\" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\setup_wipe.ENU" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\setup_wipe.EN" "setup_wipe.tmp" trying to access non-existent file "C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui" "setup_wipe.tmp" trying to access non-existent file "C:\Windows\SysWOW64\en-US\netmsg.dll.mui" "setup_wipe.tmp" trying to access non-existent file "C:\Windows\SystemResources\user32.dll.mun" "setup_wipe.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-7MFGP.tmp" "setup_wipe.tmp" trying to access non-existent file "C:\Windows\SysWOW64\uxtheme.dll.Config" "setup_wipe.tmp" trying to access non-existent file "C:\Windows\SysWOW64\en-US\imageres.dll.mui" "setup_wipe.tmp" trying to access non-existent file "C:\Windows\SysWOW64\en-US\shell32.dll.mui" "setup_wipe.tmp" trying to access non-existent file "C:\Program Files (x86)\Wipe" "setup_wipe.tmp" trying to access non-existent file "C:\Windows\WinSxS\FileMaps\program_files_x86_wipe_3238886964e6ddb7.cdf-ms"5f:T4105,Found URL "https://privacyroot.com/apps/freeware/tools-en-eula--.phpprivacy" - Source: "00000000-00002016.00000000.287768.00800000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-pp--.phpcontact" - Source: "00000000-00002016.00000000.287768.00800000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.phptahomatahomatahoma" - Source: "00000000-00002016.00000000.287768.00800000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.phptahoma" - Source: "00000000-00002016.00000000.287768.00800000.00000004.mdmp") Found URL "https://privacyroot.com\t\n\t" - Source: "00000000-00002016.00000000.287768.00800000.00000004.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00002016.00000000.287768.027F0000.00000004.mdmp") Found URL "http://privacyroot.comhttp://privacyroot.comhttp://privacyroot.comportugus" - Source: "00000000-00002016.00000000.287768.027F0000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-eula--.phpprivacy" - Source: "00000000-00002016.00000000.287768.027F0000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-pp--.phpcontact" - Source: "00000000-00002016.00000000.287768.027F0000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.phpfe2xurk0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002016.00000001.289686.0018C000.00000004.mdmp") Found URL "http://www.innosetup.com/remobjects" - Source: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found URL "http://www.remobjects.com/psexception" - Source: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-eula--.phpprivacy" - Source: "00000000-00002016.00000001.289686.00800000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-pp--.phpcontact" - Source: "00000000-00002016.00000001.289686.00800000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.phptahomatahosystem\remotetextinputprocessordefault1:\program" - Source: "00000000-00002016.00000001.289686.00800000.00000004.mdmp") Found URL "https://privacyroot.com\t\n\tusername=hapubwssystemroot=c:\windowsprocessor_level=6processor_revision=4f00number_of_processors=8homepath=\users\hapubwssessionname=consolepublic=c:\users\publicwindir=c:\windows" - Source: "00000000-00002016.00000001.289686.00800000.00000004.mdmp") Found URL "https://www.sqlite.org/copyright.htmlsqliteversion3.46.1sqlitesourceid2024-08-13" - Source: "00000000-00002016.00000002.291608.0018C000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-pp--.phpcontact" - Source: "00000000-00002016.00000002.291608.0018C000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.php14860758148607585772iww" - Source: "00000000-00002016.00000002.291608.0018C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00002016.00000002.291608.0018C000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0=604020)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0[@/ue!jq_yr" - Source: "00000000-00002016.00000002.291608.0018C000.00000004.mdmp") Found URL "https://system.data.sqlite.org/" - Source: "00000000-00002016.00000002.291608.0018C000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00002016.00000002.291608.0018C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00002016.00000002.291608.0018C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002016.00000002.291608.0018C000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-eula--.phpprivacy" - Source: "00000000-00002016.00000002.291608.00800000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-pp--.phpcontact" - Source: "00000000-00002016.00000002.291608.00800000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.php:\windows\system32\msvcrt.dll:\windows\system32\sechost.dll:\windows\system32\user32.dll:\windows\system32\win32u.dllmsctfime" - Source: "00000000-00002016.00000002.291608.00800000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.phptahomatahosystem\remotetextinputprocessordefault1:\program" - Source: "00000000-00002016.00000002.291608.00800000.00000004.mdmp") Found URL "https://privacyroot.com\t\n\tusername=hapubwssystemroot=c:\windowsprocessor_level=6processor_revision=4f00number_of_processors=8homepath=\users\hapubwssessionname=consolepublic=c:\users\publicwindir=c:\windows" - Source: "00000000-00002016.00000002.291608.00800000.00000004.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00002016.00000002.291608.027F0000.00000004.mdmp") Found URL "http://privacyroot.comhttp://privacyroot.comhttp://privacyroot.comportugus" - Source: "00000000-00002016.00000002.291608.027F0000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-eula--.phpprivacy" - Source: "00000000-00002016.00000002.291608.027F0000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-pp--.phpcontact" - Source: "00000000-00002016.00000002.291608.027F0000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.phpfe2xurk0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00002016.00000003.299035.0018C000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-eula--.phpprivacy" - Source: "00000000-00002016.00000003.299035.00800000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-pp--.phpcontact" - Source: "00000000-00002016.00000003.299035.00800000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.php:\windows\system32\msvcrt.dll:\windows\system32\sechost.dll:\windows\system32\user32.dll:\windows\system32\win32u.dllmsctfime" - Source: "00000000-00002016.00000003.299035.00800000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.phptahomatahosystem\remotetextinputprocessordefault1:\program" - Source: "00000000-00002016.00000003.299035.00800000.00000004.mdmp") Found URL "https://privacyroot.com\t\n\tusername=hapubwssystemroot=c:\windowsprocessor_level=6processor_revision=4f00number_of_processors=8homepath=\users\hapubwssessionname=consolepublic=c:\users\publicwindir=c:\windows" - Source: "00000000-00002016.00000003.299035.00800000.00000004.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00002016.00000003.299035.027F0000.00000004.mdmp") Found URL "http://privacyroot.comhttp://privacyroot.comhttp://privacyroot.comportugus" - Source: "00000000-00002016.00000003.299035.027F0000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-eula--.phpprivacy" - Source: "00000000-00002016.00000003.299035.027F0000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-pp--.phpcontact" - Source: "00000000-00002016.00000003.299035.027F0000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.phpfe2xurk" - Source: "00000000-00005796.00000002.293261.E2043000.00000002.mdmp") Found URL "https://www.privacyroot.com" - Source: "00000000-00005796.00000003.299067.04370000.00000004.mdmp") Found URL "http://cert.ssl.com/96-r806040,0*https://www.ssl.com/repository01http://crls.ssl.com/sslcom-rootca-rsa-4096-r1.crl0" - Source: "00000000-00005796.00000003.299067.04370000.00000004.mdmp") Found URL "http://cert.ssl.com/sslcom-subca-codesigning-ecc-384-r2.cer0" - Source: "00000000-00005796.00000003.299067.04370000.00000004.mdmp") Found URL "http://ocsps.ssl.com0qj0h00,0*https://www.ssl.com/repository0e0c0a;http://crls.ssl.com/sslcom-subca-codesigning-ecc-384-r2.crl0ew6enx_<%[\" - Source: "00000000-00005796.00000003.299067.04370000.00000004.mdmp") Found URL "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namead" - Source: "00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found URL "http://www.monotype.com/html/designer/des_index.htmln-usn-usn-usn-usa-ess-cza-dkn-usn-usa-ess-cza-dkn-usn-usa-ess-cza-dkhttp://www.monotype.com/html/mtname/ms_welcome.htmln-usn-usa-ess-cza-dka-ess-cza-dkttp://www.monotype.com/html/mtname/ms_welcome.htmln-usn-usa-ess-cza-dkn-usa-esn-usa-esl-siv-ser-trrsions,r" - Source: "00000000-00005796.00000003.299067.1EFB0000.00000004.mdmp") Found URL "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlinesetupkernel32.dlluxtheme.dlluserenv.dllsetupapi.dllapphelp.dllpropsys.dlldwmapi.dllcryptbase.dlloleacc.dllversion.dllprofapi.dllcomres.dllclbcatq.dllntmarta.dllwow64disablewow64fsredirectionkernel32.dllwow64revertwow64fsredirectionshell32.dlljjjjjj.tmpinnosetupldrwindowstatic/sl5=" - Source: "00000000-00007832.00000000.287665.00401000.00000020.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00007832.00000003.299008.02790000.00000004.mdmp") Found URL "http://privacyroot.comhttp://privacyroot.comhttp://privacyroot.comportugus" - Source: "00000000-00007832.00000003.299008.02790000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-eula--.phpprivacy" - Source: "00000000-00007832.00000003.299008.02790000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-pp--.phpcontact" - Source: "00000000-00007832.00000003.299008.02790000.00000004.mdmp") Found URL "https://privacyroot.com/apps/freeware/tools-en-contactus--.php" - Source: "00000000-00007832.00000003.299008.02790000.00000004.mdmp")60:T435,Found string "+ncalrpc:[OLE64A8B9B330AB4107098877EBD538]" (Indicator: "ncalrpc"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB50000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "+ncalrpc:[OLE25AEEA0D04D19733738E1A116C1B]" (Indicator: "ncalrpc"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB50000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB50000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "B+ncalrpc:[OLE25AEEA0D04D19733738E1A116C1B]" (Indicator: "ncalrpc"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp")61:T53d,Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; File: "setup_wipe.exe") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "setup_wipe.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "setup_wipe.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "setup_wipe.exe") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00002016.00000000.287768.736B1000.00000020.mdmp")62:T48a,file/memory contains long string with (Indicator: "System.Data.SqlClient"; File: "is-3PGUI.tmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp")63:T10cc,Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "setup_wipe.exe") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "setup_wipe.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "setup_wipe.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp") Found reference to API "5062826,5772,104,,GetKeyState,user32.dll,"01:14:56.140",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000000.287768.00800000.00000004.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found reference to API "32252924922,5772,104,,GetKeyState,user32.dll,"01:17:51.921",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "32252219858,5772,104,,GetKeyState,user32.dll,"01:17:51.921",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "23120987842,5772,104,,GetKeyState,user32.dll,"01:17:48.125",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "32251935740,5772,104,,GetKeyState,user32.dll,"01:17:51.921",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "32403587832,5772,104,,GetKeyState,user32.dll,"01:17:51.984",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "23110346214,5772,104,,GetKeyState,user32.dll,"01:17:48.125",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "23146486554,5772,104,,GetKeyState,user32.dll,"01:17:48.140",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "23098276668,5772,104,,GetKeyState,user32.dll,"01:17:48.109",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "23097321736,5772,104,,GetKeyState,user32.dll,"01:17:48.109",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "23134630360,5772,104,,GetKeyState,user32.dll,"01:17:48.125",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "23134753940,5772,104,,GetKeyState,user32.dll,"01:17:48.125",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "23121821486,5772,104,,GetKeyState,user32.dll,"01:17:48.125",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found reference to API "612,1560,104,,GetKeyState,user32.dll,"01:15:49.875",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp") Found reference to API "968,1560,104,,GetKeyState,user32.dll,"01:15:56.765",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005796.00000002.293261.1EB91000.00000004.mdmp") Found reference to API "9366,1560,104,,GetKeyState,user32.dll,"01:16:21.843",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005796.00000002.293261.1EB91000.00000004.mdmp")64:T763,"setup_wipe.tmp" called "FindFirstFileW" with parameter %TEMP%\is-N65SF.tmp\setup_wipe.tmp (UID: 00000000-00002016) "setup_wipe.tmp" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\* (UID: 00000000-00002016) "setup_wipe.tmp" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Wipe\unins???.* (UID: 00000000-00002016) "Wipe.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005796) "Wipe.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00005796) "Wipe.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005796) "Wipe.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005796) "Wipe.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005796) "Wipe.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00005796) "Wipe.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005796) "Wipe.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00005796) "Wipe.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00005796) "Wipe.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00005796) "Wipe.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00005796) "Wipe.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00005796) "Wipe.exe" called "FindNextFileW" with parameter 3b9003e4f27d92e40668f0efad11e022 (UID: 00000000-00005796) "Wipe.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Wipe\* (UID: 00000000-00005796) "Wipe.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\* (UID: 00000000-00005796)65:T1fec,Found string "XaEs&<)" (Indicator: "aes"; File: "setup_wipe.exe") file/memory contains long string with (Indicator: "aes"; File: "is-JP9R2.tmp") file/memory contains long string with (Indicator: "aes"; File: "is-ND52V.tmp") Found string "aES6" (Indicator: "aes"; Source: "00000000-00002016.00000001.289686.03EE0000.00000004.mdmp") Found string "IPF_Base64InkSerializedFormatWWW" (Indicator: "base64"; Source: "00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found string "IPF_Base64GIFWWWh" (Indicator: "base64"; Source: "00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found string "Specifies that ink be persisted by encoding the ISF as a base64 stream.WWWi" (Indicator: "base64"; Source: "00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found string "Specifies that ink be persisted by using a base64 encoded fortified GIF.WW1" (Indicator: "base64"; Source: "00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005796.00000001.291341.04370000.00000004.mdmp, 00000000-00005796.00000002.293261.04370000.00000004.mdmp, 00000000-00005796.00000003.299067.04370000.00000004.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00005796.00000001.291341.04370000.00000004.mdmp, 00000000-00005796.00000002.293261.04370000.00000004.mdmp, 00000000-00005796.00000003.299067.04370000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005796.00000001.291341.04370000.00000004.mdmp, 00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.04370000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.04370000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp")66:T631,"Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 1920-1079-004D3434 "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 1920-4690-004C6F38 "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 1920-4768-004CE1DC "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wipe_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002016.00000000.287768.027F0000.00000004.mdmp 00000000-00002016.00000002.291608.027F0000.00000004.mdmp 00000000-00002016.00000003.299035.027F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00002016.00000001.289686.00401000.00000020.mdmp "oftware\Microsoft\Windows\CurrentVersion\Uninstall\Wipe_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00002016.00000001.289686.03EE0000.00000004.mdmp 00000000-00002016.00000002.291608.027F0000.00000004.mdmp 00000000-00002016.00000003.299035.027F0000.00000004.mdmp67:T1f84,Found string "select UUID from Win32_ComputerSystemProduct" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005796-00002714-2750639083") Found string "select UUID from Win32_ComputerSystemProduct" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00005796-00002714-2750639083") Found string "select SerialNumber from Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00005796-00002714-2750833116") Found string "select SerialNumber from win32_bios" (Indicator: " Win32_BIOS"; Source: "00000000-00005796-00002714-2750910673") Found string "select ProcessorId from Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005796-00002714-2750985353") Found string "select ProcessorId from Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00005796-00002714-2750985353") Found string "select Manufacturer from win32_bios" (Indicator: " Win32_BIOS"; Source: "00000000-00005796-00002714-2751080212") Found string "select Manufacturer from Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00005796-00002714-2751120021") Found string "instance of Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00005796.00000001.291341.04370000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.04370000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.04370000.00000004.mdmp") Found string "select UUID from Win32_ComputerSystemProduct" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "select UUID from Win32_ComputerSystemProduct" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "select SerialNumber from Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "select SerialNumber from win32_bios" (Indicator: " Win32_BIOS"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "select ProcessorId from Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "select ProcessorId from Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "select Manufacturer from win32_bios" (Indicator: " Win32_BIOS"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "select Manufacturer from Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "elect Manufacturer from win32_bios" (Indicator: " Win32_BIOS"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "WMI.ExecQuery(select UUID from Win32_ComputerSystemProduct);" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "WMI.ExecQuery(select UUID from Win32_ComputerSystemProduct);" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "zWMI.ExecQuery(select UUID from Win32_ComputerSystemProduct);" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "zWMI.ExecQuery(select UUID from Win32_ComputerSystemProduct);" (Indicator: " Win32_ComputerSystemProduct"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "rWMI.ExecQuery(select SerialNumber from Win32_BaseBoard);" (Indicator: " Win32_BaseBoard"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "hWMI.ExecQuery(select SerialNumber from win32_bios);" (Indicator: " Win32_BIOS"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "pWMI.ExecQuery(select ProcessorId from Win32_Processor);" (Indicator: " Win32_Process"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "pWMI.ExecQuery(select ProcessorId from Win32_Processor);" (Indicator: " Win32_Processor"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "hWMI.ExecQuery(select Manufacturer from win32_bios);" (Indicator: " Win32_BIOS"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "rWMI.ExecQuery(select Manufacturer from Win32_BaseBoard);" (Indicator: " Win32_BaseBoard"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp")68:T768,Found registry deletion API: "RegDeleteKeyExW" in file "00000000-00002016.00000001.289686.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" in file "00000000-00002016.00000001.289686.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" in file "00000000-00002016.00000001.289686.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in file "00000000-00002016.00000001.289686.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW" in file "setup_wipe.exe" Found registry deletion API: "RegDeleteKeyW" in file "setup_wipe.exe" Found registry deletion API: "RegDeleteKeyExW" in "00000000-00002016.00000000.287768.736B1000.00000020.mdmp, 00000000-00002016.00000001.289686.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyW" in "00000000-00002016.00000000.287768.736B1000.00000020.mdmp" Found registry deletion API: "RegDeleteKeyExA" in "00000000-00002016.00000001.289686.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00002016.00000001.289686.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" in "00000000-00002016.00000001.289686.00401000.00000020.mdmp" Found registry deletion API: "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" in "00000000-00002016.00000001.289686.00401000.00000020.mdmp" Found registry deletion API: "RegDeleteValueW" in "00000000-00002016.00000001.289686.7370D000.00000002.mdmp"69:T140f,Found string "\Device\HarddiskVolume3\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\setup_wipe.tmp" (Indicator: "\Device\"; Source: "00000000-00007832-00000BC0-2713025289") Found string "\Device\HarddiskVolume3\Program Files (x86)\Wipe\Wipe.exe" (Indicator: "\Device\"; Source: "00000000-00002016-00000BC0-2738837197") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002016.00000000.287768.00800000.00000004.mdmp, 00000000-00002016.00000000.287768.02450000.00000004.mdmp, 00000000-00002016.00000001.289686.00800000.00000004.mdmp, 00000000-00002016.00000001.289686.02450000.00000004.mdmp, 00000000-00002016.00000002.291608.00800000.00000004.mdmp, 00000000-00002016.00000002.291608.02450000.00000004.mdmp, 00000000-00002016.00000003.299035.00800000.00000004.mdmp, 00000000-00002016.00000003.299035.02450000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002016.00000000.287768.00800000.00000004.mdmp, 00000000-00002016.00000000.287768.02450000.00000004.mdmp, 00000000-00002016.00000001.289686.00800000.00000004.mdmp, 00000000-00002016.00000001.289686.02450000.00000004.mdmp, 00000000-00002016.00000002.291608.00800000.00000004.mdmp, 00000000-00002016.00000002.291608.02450000.00000004.mdmp, 00000000-00002016.00000003.299035.00800000.00000004.mdmp, 00000000-00002016.00000003.299035.02450000.00000004.mdmp") Found string "ows\System32\Drivers\DriverD" (Indicator: "\drivers\"; Source: "00000000-00002016.00000000.287768.00800000.00000004.mdmp, 00000000-00002016.00000001.289686.00800000.00000004.mdmp, 00000000-00002016.00000002.291608.00800000.00000004.mdmp, 00000000-00002016.00000003.299035.00800000.00000004.mdmp") Found string "ows\System32\Drivers\DriverD" (Indicator: "system32\drivers"; Source: "00000000-00002016.00000000.287768.00800000.00000004.mdmp, 00000000-00002016.00000001.289686.00800000.00000004.mdmp, 00000000-00002016.00000002.291608.00800000.00000004.mdmp, 00000000-00002016.00000003.299035.00800000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002016.00000001.289686.00800000.00000004.mdmp, 00000000-00002016.00000002.291608.00800000.00000004.mdmp, 00000000-00002016.00000003.299035.00800000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005796.00000000.289419.04370000.00000004.mdmp, 00000000-00005796.00000000.289419.046F0000.00000004.mdmp, 00000000-00005796.00000000.289419.06480000.00000004.mdmp, 00000000-00005796.00000001.291341.04370000.00000004.mdmp, 00000000-00005796.00000001.291341.046F0000.00000004.mdmp, 00000000-00005796.00000001.291341.06480000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.04370000.00000004.mdmp, 00000000-00005796.00000002.293261.046F0000.00000004.mdmp, 00000000-00005796.00000002.293261.06480000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.04370000.00000004.mdmp, 00000000-00005796.00000003.299067.046F0000.00000004.mdmp, 00000000-00005796.00000003.299067.06480000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, 00000000-00005796.00000003.299067.1EDD0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005796.00000000.289419.04370000.00000004.mdmp, 00000000-00005796.00000000.289419.046F0000.00000004.mdmp, 00000000-00005796.00000000.289419.06480000.00000004.mdmp, 00000000-00005796.00000001.291341.04370000.00000004.mdmp, 00000000-00005796.00000001.291341.046F0000.00000004.mdmp, 00000000-00005796.00000001.291341.06480000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.04370000.00000004.mdmp, 00000000-00005796.00000002.293261.046F0000.00000004.mdmp, 00000000-00005796.00000002.293261.06480000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.04370000.00000004.mdmp, 00000000-00005796.00000003.299067.046F0000.00000004.mdmp, 00000000-00005796.00000003.299067.06480000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp, 00000000-00005796.00000003.299067.1EDD0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005796.00000000.289419.04370000.00000004.mdmp, 00000000-00005796.00000001.291341.04370000.00000004.mdmp, 00000000-00005796.00000002.293261.04370000.00000004.mdmp, 00000000-00005796.00000003.299067.04370000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Program Files (x86)\Wipe\Wipe.exe" (Indicator: "\Device\"; Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp")6a:T4ce,Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "setup_wipe.exe") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "setup_wipe.exe") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "setup_wipe.exe") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found reference to API "SetWinEventHook" (Indicator: "SetWinEventHook"; Source: "00000000-00002016.00000001.289686.7370D000.00000002.mdmp") Found reference to API "UnhookWinEvent" (Indicator: "UnhookWinEvent"; Source: "00000000-00002016.00000001.289686.7370D000.00000002.mdmp")6b:T7b5,Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "00000000-00002016.00000001.289686.00401000.00000020.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "setup_wipe.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "setup_wipe.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "setup_wipe.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002016.00000001.289686.00401000.00000020.mdmp, 00000000-00002016.00000002.291608.00513000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002016.00000002.291608.00513000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002016.00000002.291608.00513000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002016.00000002.291608.00513000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00002016.00000002.291608.00513000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00002016.00000002.291608.00513000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002016.00000002.291608.00513000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00002016.00000002.291608.00513000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002016.00000002.291608.00513000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002016.00000002.291608.00513000.00000002.mdmp")6c:T407,"setup_wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IS-N65SF.TMP\SETUP_WIPE.TMP"; Value: "") "setup_wipe.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\PROGRAM FILES (X86)\WIPE\WIPE.EXE"; Value: ""), "Wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: ""), "Wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: ""), "Wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: ""), "Wipe.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "")6d:T1438,"setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "OWNER"; Value: "E007000067100B7E826DDD0100") "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "06C9B6D54C6B0DD85C2598BBD99AA77CAE9BD21362B279E0E8460541DE08987B00") "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "0100000000") "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%PROGRAMFILES%\(x86)\Wipe\Wipe.exe"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "D4F6CA687744E2E8D8C5F867DF2A52DDDB63416F89B3C05E1157A35771AD6FEA00"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "INNO SETUP: SETUP VERSION"; Value: "5.6.1 (u)"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "INNO SETUP: APP PATH"; Value: "%PROGRAMFILES%\(x86)\Wipe"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "INSTALLLOCATION"; Value: "%PROGRAMFILES%\(x86)\Wipe\"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "INNO SETUP: ICON GROUP"; Value: "Wipe"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "INNO SETUP: USER"; Value: "ISln4Ts"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "INNO SETUP: LANGUAGE"; Value: "english"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "DISPLAYNAME"; Value: "Wipe version 2613.00"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "DISPLAYICON"; Value: "%PROGRAMFILES%\(x86)\Wipe\unins000.exe"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "UNINSTALLSTRING"; Value: ""%PROGRAMFILES%\(x86)\Wipe\unins000.exe""), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "QUIETUNINSTALLSTRING"; Value: ""%PROGRAMFILES%\(x86)\Wipe\unins000.exe" /SILENT"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "DISPLAYVERSION"; Value: "2613.00"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "PUBLISHER"; Value: "PrivacyRoot IFG"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "URLINFOABOUT"; Value: "http://privacyroot.com"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "HELPLINK"; Value: "http://privacyroot.com"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "URLUPDATEINFO"; Value: "http://privacyroot.com"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "NOMODIFY"; Value: "0100000000"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "NOREPAIR"; Value: "0100000000"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "INSTALLDATE"; Value: "20261105"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "MAJORVERSION"; Value: "350A000000"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "MINORVERSION"; Value: "0000000000"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "VERSIONMAJOR"; Value: "350A000000"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "VERSIONMINOR"; Value: "0000000000"), "setup_wipe.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WIPE_IS1"; Key: "ESTIMATEDSIZE"; Value: "524E000000"), "Wipe.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "WIPE UPDATES"; Value: ""%PROGRAMFILES%\(x86)\Wipe\Wipe.exe" uf_sub_winStartup")6e:T4104,Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-LMHMH.tmp" has high entropy 7.98523 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JP9R2.tmp" has high entropy 7.98325 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-RB2LR.tmp" has high entropy 7.97384 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4LLSM.tmp" has high entropy 7.9822 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BFS76.tmp" has high entropy 7.97885 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-6O0SS.tmp" has high entropy 7.95327 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-3BA22.tmp" has high entropy 7.978 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\is-UEFDI.tmp" has high entropy 7.96975 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-G4SIA.tmp" has high entropy 7.95433 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-O4I1D.tmp" has high entropy 7.92917 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-931LS.tmp" has high entropy 7.96372 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4GISE.tmp" has high entropy 7.96459 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-3I6RC.tmp" has high entropy 7.9704 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IMI89.tmp" has high entropy 7.97063 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-5JS01.tmp" has high entropy 7.94987 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-DB3IM.tmp" has high entropy 7.97007 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-K981T.tmp" has high entropy 7.97157 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-0H37S.tmp" has high entropy 7.96042 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-5TNAA.tmp" has high entropy 7.9572 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-EDSHH.tmp" has high entropy 7.97498 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-1P09O.tmp" has high entropy 7.96844 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-P9BAD.tmp" has high entropy 7.95167 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-5QFMT.tmp" has high entropy 7.95292 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-MTITL.tmp" has high entropy 7.94519 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-5QJR3.tmp" has high entropy 7.96483 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-ENH17.tmp" has high entropy 7.98082 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-K6VOC.tmp" has high entropy 7.943 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-2M7V4.tmp" has high entropy 7.96593 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-23HAI.tmp" has high entropy 7.96257 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4ON0V.tmp" has high entropy 7.9554 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BN8EA.tmp" has high entropy 7.96542 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-UPRSF.tmp" has high entropy 7.95504 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-L7DT7.tmp" has high entropy 7.95568 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BU8LF.tmp" has high entropy 7.95851 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-9MV2A.tmp" has high entropy 7.95546 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-MJEHT.tmp" has high entropy 7.88373 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-DQBP8.tmp" has high entropy 7.91771 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-UJ30R.tmp" has high entropy 7.95852 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-9I9OD.tmp" has high entropy 7.95431 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NCNTG.tmp" has high entropy 7.94922 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-DBRPL.tmp" has high entropy 7.94813 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-O7G9K.tmp" has high entropy 7.94612 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IOG2N.tmp" has high entropy 7.94882 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\is-50KQU.tmp" has high entropy 7.93747 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-QUEHA.tmp" has high entropy 7.93064 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NHNFO.tmp" has high entropy 7.90155 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-0MSNP.tmp" has high entropy 7.95251 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-CF6J1.tmp" has high entropy 7.95067 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-J7A5B.tmp" has high entropy 7.95359 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-7T02D.tmp" has high entropy 7.94624 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-1Q9BU.tmp" has high entropy 7.90055 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-R8GJ0.tmp" has high entropy 7.92839 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-QG5UG.tmp" has high entropy 7.96194 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-ULG52.tmp" has high entropy 7.93396 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-K15QD.tmp" has high entropy 7.93968 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-R13M7.tmp" has high entropy 7.92797 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-H5OP3.tmp" has high entropy 7.93999 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-6OVAS.tmp" has high entropy 7.93449 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-VH5O4.tmp" has high entropy 7.91461 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JLA1Q.tmp" has high entropy 7.81204 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-6K57O.tmp" has high entropy 7.90869 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IVLNU.tmp" has high entropy 7.93659 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-V16GF.tmp" has high entropy 7.91682 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-KBPV5.tmp" has high entropy 7.92547 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-8LS50.tmp" has high entropy 7.94713 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JBRLP.tmp" has high entropy 7.93257 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-TI38C.tmp" has high entropy 7.87592 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-9NMG4.tmp" has high entropy 7.86837 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JURRI.tmp" has high entropy 7.84309 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NI0B6.tmp" has high entropy 7.877 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-V22M1.tmp" has high entropy 7.82988 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-CITK8.tmp" has high entropy 7.82022 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-9L8O5.tmp" has high entropy 7.82013 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-B4QL1.tmp" has high entropy 7.84584 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\is-CE3OB.tmp" has high entropy 7.43412 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-34ER0.tmp" has high entropy 7.71924 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-7FSIL.tmp" has high entropy 7.78739 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-SQEOO.tmp" has high entropy 7.72176 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-UVSQH.tmp" has high entropy 7.635 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-2J4DE.tmp" has high entropy 7.84409 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\is-TKF84.tmp" has high entropy 7.66634 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-8V579.tmp" has high entropy 7.80667 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\is-2ITPL.tmp" has high entropy 7.59937 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4J4SA.tmp" has high entropy 7.78294 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NEJLO.tmp" has high entropy 7.76721 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JL7Q9.tmp" has high entropy 7.76295 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-M63II.tmp" has high entropy 7.75357 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-SR81M.tmp" has high entropy 7.77815 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-GVF5S.tmp" has high entropy 7.7469 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JPV1O.tmp" has high entropy 7.72294 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-3OA5C.tmp" has high entropy 7.72071 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-S0VET.tmp" has high entropy 7.74309 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-OILBQ.tmp" has high entropy 7.07244 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-8BSLL.tmp" has high entropy 7.69491 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NF315.tmp" has high entropy 7.68754 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-E384O.tmp" has high entropy 7.65933 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-TBJA6.tmp" has high entropy 7.65453 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-QIGKJ.tmp" has high entropy 7.68844 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-2PTMA.tmp" has high entropy 7.62071 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-4H4IT.tmp" has high entropy 7.68292 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-GUA43.tmp" has high entropy 7.63127 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-TS482.tmp" has high entropy 7.58849 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-VEL0T.tmp" has high entropy 7.64309 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-O0C2S.tmp" has high entropy 7.58758 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-6NCLT.tmp" has high entropy 7.57471 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-CB7N1.tmp" has high entropy 7.59738 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-TLAVE.tmp" has high entropy 7.62973 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-UBBOM.tmp" has high entropy 7.61681 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-21BN7.tmp" has high entropy 7.55645 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-497B2.tmp" has high entropy 7.53812 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-P5SEC.tmp" has high entropy 7.58612 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-T7JO9.tmp" has high entropy 7.59359 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-LC8P8.tmp" has high entropy 7.56618 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-FRFIM.tmp" has high entropy 7.53896 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-F25L4.tmp" has high entropy 7.62934 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-O4DJV.tmp" has high entropy 7.57997 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IBUSI.tmp" has high entropy 7.52197 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-TRFGT.tmp" has high entropy 7.54277 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-PHP7Q.tmp" has high entropy 7.52573 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-PUTAU.tmp" has high entropy 7.59945 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JVDPA.tmp" has high entropy 7.44869 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-K3MK1.tmp" has high entropy 7.51399 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-425B9.tmp" has high entropy 7.53354 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BTH5S.tmp" has high entropy 7.45317 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-163L5.tmp" has high entropy 7.53923 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-RU8H9.tmp" has high entropy 7.51584 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-QQMDP.tmp" has high entropy 7.54947 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-F6PDP.tmp" has high entropy 7.49834 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BT85U.tmp" has high entropy 7.52909 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-T85Q6.tmp" has high entropy 7.36331 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-74RG5.tmp" has high entropy 7.50884 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-1SIIM.tmp" has high entropy 7.44629 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-DVSJ2.tmp" has high entropy 7.43799 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-S6U6N.tmp" has high entropy 7.45251 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-978J1.tmp" has high entropy 7.51298 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-7VPNF.tmp" has high entropy 7.39129 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-71J01.tmp" has high entropy 7.40257 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-ECSGJ.tmp" has high entropy 7.44055 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-82EFH.tmp" has high entropy 7.43587 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-8O7O8.tmp" has high entropy 7.41992 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-N05ST.tmp" has high entropy 7.42202 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-VHNJS.tmp" has high entropy 7.38708 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IIPFG.tmp" has high entropy 7.42418 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-0T78O.tmp" has high entropy 7.45186 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-B6T4P.tmp" has high entropy 7.34301 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BUP3G.tmp" has high entropy 7.39284 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-N7FT7.tmp" has high entropy 7.35114 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-B6IQ4.tmp" has high entropy 7.40132 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-BHLP8.tmp" has high entropy 7.34577 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-JEDPS.tmp" has high entropy 7.42224 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-88LEM.tmp" has high entropy 7.37022 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-FHQCG.tmp" has high entropy 7.31184 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-7T5FQ.tmp" has high entropy 7.51682 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-7A2OS.tmp" has high entropy 7.45406 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-MMPC8.tmp" has high entropy 7.42678 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-VJAP7.tmp" has high entropy 7.37701 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-P0230.tmp" has high entropy 7.3619 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-NEP89.tmp" has high entropy 7.41622 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-9CUFS.tmp" has high entropy 7.37551 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-GM78P.tmp" has high entropy 7.45576 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-IO4LI.tmp" has high entropy 7.34705 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-DPUBG.tmp" has high entropy 7.35292 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-FS9D1.tmp" has high entropy 7.38266 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-S5DT1.tmp" has high entropy 7.35621 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-OBD9U.tmp" has high entropy 7.34625 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-HDRNA.tmp" has high entropy 7.18219 Dropped file "%PROGRAMFILES%\(x86)\Wipe\Application\Plugins\is-0GENP.tmp" has high entropy 7.974986f:T4b0,"setup_wipe.exe" wrote 13328 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-N65SF.tmp\setup_wipe.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a000000000000000000000000000000000000000000496e556e000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "setup_wipe.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-7MFGP.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "setup_wipe.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Program Files (x86)\Wipe\is-N6FCS.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a000000000000000000000000000000000000000000496e556e000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ...70:T409,SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-313-004FC60C SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-3172-0042DDBC SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-3173-0042DEAC SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-3174-0042DF9C SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-3469-00450820 SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-3711-00465670 SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-3833-00479E24 SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-3838-0046916C SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-3839-004690C4 SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-3962-0047A738 SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-3963-0047A708 SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-4009-0047A794 SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-4052-0047A450 SystemParametersInfoW@USER32.DLL at 00000000-00002016-1920-4623-004C04EC71:Td4d,Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00005796-00002713-2750546129") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00002016.00000003.299035.037E0000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "Use Control Panel to manage system restore points.\Settings\Checkboxes.iniCheckboxes\Settings\Settings.ini*.*RESET_IMG_CACHEOk!REM_AUTO_EXCL132VIEW_AUTO_EXCLHKEY_HKCUHKLM,DIVE,DELTOP\custom_items.txtWRITE_CUST_ITEMSDIVEWith subdirs, DELTOPWith top item, READ_CUST_ITEMSB16_CLICKB18_CLICKB19_CLICKB20_CLICK133134ShutDownON\FunStarts\\FunStarts\en.txtFUN_GET_QUOTENO_FUN_STARTS_QUOTES;FUN_RANDOMInitializing ...ERROR 7091: Failed to start cleaner. Queue is not empty.135Software\Microsoft\Windows NT\CurrentVersion\SystemRestoreSystemRestorePointCreationFrequencySYS_REST_OPENwinmgmts:{impersonationLevel=impersonate}!root/default:SystemRestoreBefore cleanup by CreateRestorePointSYS_REST_CREATERESTORE POINT ERROR:" (Indicator: "winmgmts:"; in Source: "00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp") Found string "WMI.ExecQuery(select UUID from Win32_ComputerSystemProduct);" (Indicator: "wmi.exe"; in Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "zWMI.ExecQuery(select UUID from Win32_ComputerSystemProduct);" (Indicator: "wmi.exe"; in Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "rWMI.ExecQuery(select SerialNumber from Win32_BaseBoard);" (Indicator: "wmi.exe"; in Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "hWMI.ExecQuery(select SerialNumber from win32_bios);" (Indicator: "wmi.exe"; in Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "pWMI.ExecQuery(select ProcessorId from Win32_Processor);" (Indicator: "wmi.exe"; in Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "hWMI.ExecQuery(select Manufacturer from win32_bios);" (Indicator: "wmi.exe"; in Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp") Found string "rWMI.ExecQuery(select Manufacturer from Win32_BaseBoard);" (Indicator: "wmi.exe"; in Source: "00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp")72:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAADswAAAAADsAAAAAAAAAAAA7MAAAAAC7MAAAAAAAAAAAu7AAAAADuzAAAAAAAAAAAbuzAAAAA7uwAAAAAAAAAAO7swAAAAu4sAAAAAAAAAADu7sQAAAbuLMAAAAAAAAAC7u7MRERO4izAAAAAAAAADu7uzERETu7uwAAAAAAAAA7u7OxERG7u7swAAAAAAAAu7szsRETu7szMAAAAAAAA7u7MbMRE7u7EzAAAAAAAAO7uxEzERu7sxGxAAAAAAALu7sROxE7u7MRswAAAAAAO7uzETsxO7uxETMAAAAAADu7sxEbMbu7sRE7AAAAAAC7u7ERE7G7uzERGzAAAAABu7uxERO7u7sxERswAAAAA7u7MREZu7u7ERETsAAAAAO7uzEZkbu7uxERE7MAAAALu7sRmZk7i7MRERGzAAAAO7u7GZmZO4u5kRERtwAAAHu7sxmZmZuLuZEREbsAAAC7u7OZmZmbizmZERG7MAADuIuzmZmZk7s5mRERu3AAe4iIi3OZmZO7mZkReIiHM7uIiLu7mZmZt5mZE7iIizAAABEREZmZmZmZkRERAAAAAAABERmZmZmZmZEREAAAAAAAABERmZmZmZkREQAAAAAAAAAAERmZmZmREQAAAAAAAAAAAAAREREREQAAAAAAD/gAH//wAA//4AAH/4AAAf8AAAD+AAAAfgAAAHwAAAA8AAAAOAAAABgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABgAAAAcAAAAPAAAABAAAAAAAAAAAAAAAA/AAAP/4AAH//gAH//+AH/w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1793923800902,"unified_at":"2026-11-06T00:10:00.902Z","metadata":{"hashes":{"sha256":"f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","sha1":"3d075ea73ab4d4fe8bba43b4cc5d29b048cc4dd7","md5":"fa32ed6f9ae20468ee538487f18e3bbc","sha512":"b5f2680fb05763bae7ab5709da7087ffd380006f85a2a0b0daaf50b811f0a5386f230f86a9898b10ad1e309b5f063ec995c951aa2d291e74f27c9280063ecca1","ssdeep":"98304:cmKqIaaL/Y64gzEoWVyLshgVDDVxcQqBo7U0N61ZZs+WGZUmgqSuLKZkV4OiSwFD:bKqwDMCEPyLsh0/o4z+7gqSYK+DiRV","ssdeep_chunks":["98304:cmKqIaa","98304:mKqIaaL","98304:KqIaaL/","98304:qIaaL/Y","98304:IaaL/Y6","98304:aaL/Y64","98304:aL/Y64g","98304:L/Y64gz","98304:/Y64gzE","98304:Y64gzEo","98304:64gzEoW","98304:4gzEoWV","98304:gzEoWVy","98304:zEoWVyL","98304:EoWVyLs","98304:oWVyLsh","98304:WVyLshg","98304:VyLshgV","98304:yLshgVD","98304:LshgVDD","98304:shgVDDV","98304:hgVDDVx","98304:gVDDVxc","98304:VDDVxcQ","98304:DDVxcQq","98304:DVxcQqB","98304:VxcQqBo","98304:xcQqBo7","98304:cQqBo7U","98304:QqBo7U0","98304:qBo7U0N","98304:Bo7U0N6","98304:o7U0N61","98304:7U0N61Z","98304:U0N61ZZ","98304:0N61ZZs","98304:N61ZZs+","98304:61ZZs+W","98304:1ZZs+WG","98304:ZZs+WGZ","98304:Zs+WGZU","98304:s+WGZUm","98304:+WGZUmg","98304:WGZUmgq","98304:GZUmgqS","98304:ZUmgqSu","98304:UmgqSuL","98304:mgqSuLK","98304:gqSuLKZ","98304:qSuLKZk","98304:SuLKZkV","98304:uLKZkV4","98304:LKZkV4O","98304:KZkV4Oi","98304:ZkV4OiS","98304:kV4OiSw","98304:V4OiSwF","98304:4OiSwFD","196608:cmKqIaa","196608:mKqIaaL","196608:KqIaaL/","196608:qIaaL/Y","196608:IaaL/Y6","196608:aaL/Y64","196608:aL/Y64g","196608:L/Y64gz","196608:/Y64gzE","196608:Y64gzEo","196608:64gzEoW","196608:4gzEoWV","196608:gzEoWVy","196608:zEoWVyL","196608:EoWVyLs","196608:oWVyLsh","196608:WVyLshg","196608:VyLshgV","196608:yLshgVD","196608:LshgVDD","196608:shgVDDV","196608:hgVDDVx","196608:gVDDVxc","196608:VDDVxcQ","196608:DDVxcQq","196608:DVxcQqB","196608:VxcQqBo","196608:xcQqBo7","196608:cQqBo7U","196608:QqBo7U0","196608:qBo7U0N","196608:Bo7U0N6","196608:o7U0N61","196608:7U0N61Z","196608:U0N61ZZ","196608:0N61ZZs","196608:N61ZZs+","196608:61ZZs+W","196608:1ZZs+WG","196608:ZZs+WGZ","196608:Zs+WGZU","196608:s+WGZUm","196608:+WGZUmg","196608:WGZUmgq","196608:GZUmgqS","196608:ZUmgqSu","196608:UmgqSuL","196608:mgqSuLK","196608:gqSuLKZ","196608:qSuLKZk","196608:SuLKZkV","196608:uLKZkV4","196608:LKZkV4O","196608:KZkV4Oi","196608:ZkV4OiS","196608:kV4OiSw","196608:V4OiSwF","196608:4OiSwFD","98304:bKqwDMC","98304:KqwDMCE","98304:qwDMCEP","98304:wDMCEPy","98304:DMCEPyL","98304:MCEPyLs","98304:CEPyLsh","98304:EPyLsh0","98304:PyLsh0/","98304:yLsh0/o","98304:Lsh0/o4","98304:sh0/o4z","98304:h0/o4z+","98304:0/o4z+7","98304:/o4z+7g","98304:o4z+7gq","98304:4z+7gqS","98304:z+7gqSY","98304:+7gqSYK","98304:7gqSYK+","98304:gqSYK+D","98304:qSYK+Di","98304:SYK+DiR","98304:YK+DiRV"],"imphash":"20dd26497880c05caed9305b3c8b9109","pehash":"4931298ffc38102e69686598a24c7aaab1533b5f"},"file_info":{"file_name":"setup_wipe.exe","file_type":["compressed","innosetup"],"file_type_id":"innosetup","file_size":6235448,"entropy":8,"compile_timestamp":"2018-06-14T13:27:46","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793923485000,"last_seen":1793923485000,"last_multi_scan":1793923485000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":62044,"raw_size":62464},{"name":".itext","virtual_address":"0x11000","virtual_size":4004,"raw_size":4096},{"name":".data","virtual_address":"0x12000","virtual_size":3212,"raw_size":3584},{"name":".bss","virtual_address":"0x13000","virtual_size":22204},{"name":".idata","virtual_address":"0x19000","virtual_size":3588,"raw_size":4096},{"name":".tls","virtual_address":"0x1a000","virtual_size":8},{"name":".rdata","virtual_address":"0x1b000","virtual_size":24,"raw_size":512},{"name":".rsrc","virtual_address":"0x1c000","virtual_size":109140,"raw_size":109568}],"section_names":[".text",".itext",".data",".bss",".idata",".tls",".rdata",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":["yandex","evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":84},"sandbox_signatures":{"informative_count":236,"suspicious_count":14,"malicious_count":1,"total":251},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to list processes on remote desktop session host"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Able to download remote files using web shell script"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Contains ability to remove directories"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Contains ability to create named pipes for inter-process communication (IPC)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"informative","value":"Contains ability to query sqlite firefox history"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Able to manipulate a file/directory time format"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Selective Exclusion","attack_id":"T1679","attack_id_wiki":"https://attack.mitre.org/techniques/T1679","identifiers":[{"type":"informative","value":"Attempts to rename multiple files with a new extension, avoiding critical system files"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]}],"sandbox_signatures":[{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Borland\\Delphi\\RTL\" in Source: sample.bin, \"Software\\Borland\\Locales\" in Source: sample.bin, \"Software\\Borland\\Delphi\\Locales\" in Source: sample.bin, \"Software\\CodeGear\\Locales\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-324","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"z'ms,..bj\", Heuristic match: \"}t/$v.gf\", Pattern match: \"http://schemas.microsoft.com/smi/2\", Pattern match: \"http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline\", Heuristic match: \"p\na.mv\", Heuristic match: \"v3.ne\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"setup_wipe.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"setup_wipe.exe\" called \"FindResourceW\" with parameter \"11111\" - (UID: 00000000-00007832)\n \"setup_wipe.tmp\" called \"FindResourceW\" with parameter \"43075060\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"FindResourceW\" with parameter \"42957244\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"FindResourceW\" with parameter \"42928860\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"FindResourceW\" with parameter \"42957340\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"FindResourceW\" with parameter \"42929100\" - (UID: 00000000-00002016)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"setup_wipe.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4310192'}\" (UID: 00000000-00007832)\n \"setup_wipe.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5327496'}\" (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5327544'}\" (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5327640'}\" (UID: 00000000-00002016)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"setup_wipe.exe\")\n Found reference to API \"RegSetValueEx\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002016.00000001.289686.7370D000.00000002.mdmp, 00000000-00002016.00000002.291608.00513000.00000002.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002016.00000002.291608.00513000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"setup_wipe.exe\")\n Found reference to API \"SetLastWriteTime\" (Indicator: \"SetLastWriteTime\"; Source: \"00000000-00005796.00000002.293261.041E2000.00000002.mdmp\")\n Found reference to API \"SetCreationTime\" (Indicator: \"SetCreationTime\"; Source: \"00000000-00005796.00000002.293261.041E2000.00000002.mdmp\")\n Found reference to API \"SetLastAccessTime\" (Indicator: \"SetLastAccessTime\"; Source: \"00000000-00005796.00000002.293261.041E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$37","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002016.00000002.291608.00513000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00005796-00002713-2750546129\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY1; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"setup_wipe.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"setup_wipe.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"setup_wipe.tmp\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"setup_wipe.tmp\" set its error mode to SEM_FAILCRITICALERRORS\n \"Wipe.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Wipe.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$38","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$39","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$3a","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"setup_wipe.tmp\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00005796.00000002.293261.041E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00005796.00000000.289419.04370000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002016.00000000.287768.00800000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00005796.00000000.289419.04370000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00005796.00000000.289419.04370000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$3b","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002016.00000000.287768.00800000.00000004.mdmp, 00000000-00002016.00000001.289686.00800000.00000004.mdmp, 00000000-00002016.00000002.291608.00800000.00000004.mdmp, 00000000-00002016.00000003.299035.00800000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00005796.00000000.289419.04370000.00000004.mdmp, 00000000-00005796.00000001.291341.04370000.00000004.mdmp, 00000000-00005796.00000002.293261.04370000.00000004.mdmp, 00000000-00005796.00000003.299067.04370000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99172","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"setup_wipe.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"setup_wipe.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005796-00000C2C-2742973143\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00002016.00000003.299035.037E0000.00000004.mdmp\")\n Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00002016.00000003.299035.037E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005796-00000C2C-2742973143\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00005796-00000C2C-2744125631\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002016.00000001.289686.7370D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"Found string \"SetLastWriteTime\" (Indicator: \"setlastwritetime\"; Source: \"00000000-00005796.00000002.293261.041E2000.00000002.mdmp\")\n Found string \"SetCreationTime\" (Indicator: \"setcreationtime\"; Source: \"00000000-00005796.00000002.293261.041E2000.00000002.mdmp\")\n Found string \"SetLastAccessTime\" (Indicator: \"setlastaccesstime\"; Source: \"00000000-00005796.00000002.293261.041E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Wipe.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005796)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"setup_wipe.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007832)\n \"setup_wipe.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007832)\n \"setup_wipe.tmp\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"QueryPerformanceCounter\" (UID: 00000000-00002016)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"setup_wipe.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007832)\n \"setup_wipe.tmp\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002016)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"setup_wipe.tmp\" called \"IsWow64Process\" with parameter \"2016\" - (UID: 00000000-00002016)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"setup_wipe.tmp\" called \"EnumWindows\" with parameter \"1703020\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"EnumWindows\" with parameter \"1699628\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"EnumWindows\" with parameter \"1699556\" - (UID: 00000000-00002016)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"setup_wipe.tmp\" called \"GetWindowTextW\" with parameter \"License Agreement\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"GetWindowTextW\" with parameter \"Please read the following important information before continuing.\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"GetWindowTextW\" with parameter \"Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"GetWindowTextW\" with parameter \"I &accept the agreement\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"GetWindowTextW\" with parameter \"I &do not accept the agreement\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"GetWindowTextW\" with parameter \"&Next >\" - (UID: 00000000-00002016)\n \"setup_wipe.tmp\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00002016)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"setup_wipe.tmp\" called \"GetActiveWindow\" (UID: 00000000-00002016)\n \"Wipe.exe\" called \"GetActiveWindow\" (UID: 00000000-00005796)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"setup_wipe.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007832)\n \"setup_wipe.tmp\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002016)\n \"Wipe.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005796)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$40","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$41","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"setup_wipe.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007832)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"$42","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00007832-405-37-00405BEC\n FindFirstFileW@KERNEL32.DLL at 00000000-00002016-1920-37-00408174\n FindNextFileW@KERNEL32.DLL at 00000000-00002016-1920-177-004AED78\n FindFirstFileW@KERNEL32.DLL at 00000000-00002016-1920-189-004AD600\n FindNextFileW@KERNEL32.DLL at 00000000-00002016-1920-983-004E35F0\n FindNextFileW@KERNEL32.DLL at 00000000-00002016-1920-1094-004D22BC\n FindNextFileW@KERNEL32.DLL at 00000000-00002016-1920-4457-004AF05C\n FindFirstFileW@KERNEL32.DLL at 00000000-00002016-1920-4618-004BFEBC\n FindFirstFileW@KERNEL32.DLL at 00000000-00002016-1920-4644-004C1640\n FindFirstFileW@KERNEL32.DLL at 00000000-00002016-1920-4652-004C1AFC\n FindNextFileW@KERNEL32.DLL at 00000000-00002016-1920-4721-004E0A34\n FindFirstFileW@KERNEL32.DLL at 00000000-00002016-1920-4794-004D62F8\n FindFirstFileW@KERNEL32.DLL at 00000000-00002016-1920-5171-004FFC74","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDrives@KERNEL32.DLL at 00000000-00002016-1920-4642-004C1564\n GetDriveTypeW@KERNEL32.DLL at 00000000-00002016-1920-4650-004C1994\n GetDriveTypeW@KERNEL32.DLL at 00000000-00002016-1920-4737-004CAB94","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"file/memory contains long string with (Indicator: \"select * from \"; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"setup_wipe.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"setup_wipe.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002016-1920-174-004B2BD4\n FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00002016-1920-1110-004CD5A0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002016-1920-1124-004B39E4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002016-1920-4502-004B2B90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002016-1920-174-004B2BD4\n GetLocalTime@KERNEL32.DLL at 00000000-00002016-1920-714-0040F604\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002016-1920-1124-004B39E4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002016-1920-4502-004B2B90\n GetLocalTime@KERNEL32.DLL at 00000000-00002016-1920-4766-004CDA64\n GetLocalTime@KERNEL32.DLL at 00000000-00002016-1920-4773-004CE050\n GetLocalTime@KERNEL32.DLL at 00000000-00002016-1920-5106-0040F5B4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@kernel32.dll at 65262-1251-00406708\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007832-405-36-00405DE8\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007832-405-51-00408F00\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007832-405-58-00408EB4\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00007832-405-358-0040E658\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00002016-1920-36-00408370\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00002016-1920-51-0041107C\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00002016-1920-58-00411030\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00002016-1920-4482-004B1118","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@kernel32.dll at 65262-1475-004066D0\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00007832-405-250-00408068\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00002016-1920-2822-0040DCF4\n GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00002016-1920-4478-004B0DE4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"setup_wipe.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"setup_wipe.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"setup_wipe.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"setup_wipe.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"Wipe.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"setup_wipe.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"setup_wipe.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"setup_wipe.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002016.00000001.289686.7370D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@kernel32.dll at 65262-1299-004011B8\n GetSystemInfo@KERNEL32.DLL at 00000000-00007832-405-91-00406458\n GetSystemInfo@KERNEL32.DLL at 00000000-00007832-405-383-0040ED58\n GetSystemInfo@KERNEL32.DLL at 00000000-00002016-1920-91-00408DD0\n GetSystemInfo@KERNEL32.DLL at 00000000-00002016-1920-5202-004E7FCC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver %1\" (Indicator: \"ver \") in Source: 00000000-00002016.00000000.287768.027F0000.00000004.mdmp\n 00000000-00002016.00000002.291608.027F0000.00000004.mdmp\n 00000000-00002016.00000003.299035.027F0000.00000004.mdmp\n Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00005796.00000000.289419.04370000.00000004.mdmp\n 00000000-00005796.00000001.291341.04370000.00000004.mdmp\n 00000000-00005796.00000002.293261.04370000.00000004.mdmp\n 00000000-00005796.00000003.299067.04370000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetKeyboardType@user32.dll at 65262-1297-004036DC\n GetUserDefaultLangID@kernel32.dll at 65262-1573-004067BC\n GetKeyboardType@USER32.DLL at 00000000-00007832-405-90-004036E4\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00007832-405-359-0040E684\n GetKeyboardType@USER32.DLL at 00000000-00007832-405-406-004035B3\n GetKeyboardType@USER32.DLL at 00000000-00002016-1920-90-00403E38\n GetKeyboardLayoutList@USER32.DLL at 00000000-00002016-1920-474-00479A4C\n GetKeyboardLayoutNameW@USER32.DLL at 00000000-00002016-1920-3483-00452778\n GetKeyboardLayout@USER32.DLL at 00000000-00002016-1920-3490-00452980\n GetKeyboardLayout@USER32.DLL at 00000000-00002016-1920-3832-00479464\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00002016-1920-4483-004B1144\n GetKeyboardType@USER32.DLL at 00000000-00002016-1920-5231-00403D07","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"Found string \"%username%\" (Indicator: \"%username%\"; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"%username%\"; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-557","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00002016-1920-979-004B0418\n OpenProcessToken@ADVAPI32.DLL at 00000000-00002016-1920-4104-00480084\n OpenProcessToken@ADVAPI32.DLL at 00000000-00002016-1920-4903-004DA168\n OpenProcess@KERNEL32.DLL at 00000000-00002016-1920-5153-004FD9E4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"Wipe.exe\" issued a query \"select UUID from Win32_ComputerSystemProduct\"\n \"Wipe.exe\" issued a query \"select SerialNumber from Win32_BaseBoard\"\n \"Wipe.exe\" issued a query \"select SerialNumber from win32_bios\"\n \"Wipe.exe\" issued a query \"select ProcessorId from Win32_Processor\"\n \"Wipe.exe\" issued a query \"select Manufacturer from win32_bios\"\n \"Wipe.exe\" issued a query \"select Manufacturer from Win32_BaseBoard\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$45","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"setup_wipe.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"setup_wipe.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"setup_wipe.exe\" queried token user identity (UID: 00000000-00007832)\n \"setup_wipe.tmp\" queried token user identity (UID: 00000000-00002016)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$46","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"setup_wipe.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Wipe.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Wipe.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"setup_wipe.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WIPE_IS1\")\n \"setup_wipe.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WIPE_IS1\")\n \"Wipe.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WIPE.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"select ProcessorId from Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00005796-00002714-2750985353\")\n Found string \"select ProcessorId from Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp\")\n Found string \"pWMI.ExecQuery(select ProcessorId from Win32_Processor);\" (Indicator: \" Win32_Process\"; Source: \"00000000-00005796.00000001.291341.1EB50000.00000004.mdmp, 00000000-00005796.00000002.293261.1EB91000.00000004.mdmp, 00000000-00005796.00000003.299067.1EB50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyEx\" in file \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"setup_wipe.exe\"\n Found registry modification API: \"RegCreateKeyEx\" in \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002016.00000001.289686.7370D000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00002016.00000002.291608.00513000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"setup_wipe.exe\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002016.00000001.289686.7370D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$47","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"setup_wipe.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-N65SF.tmp\\setup_wipe.tmp\" /SL5=\"$60380\n5735482\n185344\nC:\\setup_wipe.exe\"\" - (UID: 00000000-00007832)\n \"setup_wipe.tmp\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Wipe\\Wipe.exe\" uf_sub_runonsetup\" - (UID: 00000000-00002016)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$48","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$49","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$4a","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.DLL at 00000000-00002016-1920-1124-004B39E4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1559","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$4c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"$4d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; File: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileEx failed (%d).\" (Indicator: \"MoveFile\"; File: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"setup_wipe.exe\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"setup_wipe.exe\")\n Found reference to API \"MoveFile\" (Indicator: \"MoveFile\"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileEx\" (Indicator: \"MoveFile\"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found reference to API \"MoveFileEx failed (%d).\" (Indicator: \"MoveFile\"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"setup_wipe.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"setup_wipe.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"setup_wipe.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00002016.00000001.289686.7370D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.7370D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4f","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"is-J7Q5K.tmp\" as clean (type is \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 Mono/.Net assembly 2 sections\"), Antivirus vendors marked dropped file \"_setup64.tmp\" as clean (type is \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"), Antivirus vendors marked dropped file \"is-N6FCS.tmp\" as clean (type is \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$50","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"setup_wipe.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"setup_wipe.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"is-J7Q5K.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"rn@g.ot\"\n Pattern match: \"jbrugger@gmx.net\"\n Pattern match: \"nars@gmx.net\"\n Pattern match: \"peter.stadler@univie.ac.at\"\n Pattern match: \"pierre@levosgien.net\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"//./root/cimv2\" [Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp\n 00000000-00005796.00000002.293261.06490000.00000004.mdmp\n 00000000-00005796.00000003.299067.06490000.00000004.mdmp]\n Observed WMI keyword:\"{impersonationLevel=impersonate}\" [Source: 00000000-00005796.00000001.291341.06490000.00000004.mdmp\n 00000000-00005796.00000002.293261.06490000.00000004.mdmp\n 00000000-00005796.00000003.299067.06490000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$51","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$52","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Wipe.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\3b9003e4f27d92e40668f0efad11e022\\mscorlib.ni.dll\" at BC1F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"Wipe.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at E2090000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"setup_wipe.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 759E0000\n \"setup_wipe.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73AC0000\n \"Wipe.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F0630000\n \"Wipe.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at EF830000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"Wipe.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at BD880000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"setup_wipe.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75F40000\n \"setup_wipe.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75F40000\n \"Wipe.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at F0F00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020421cf0fa7f0000@ntdll.dll\"\n \"220023000000000040421cf0fa7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"setup_wipe.exe\" was detected as \"Inno Setup Module\" and name: \"Installer\"\n \"setup_wipe.exe\" was detected as \"Embarcadero Delphi\" and name: \"Compiler\"\n \"setup_wipe.exe\" was detected as \"Turbo Linker\" and name: \"Linker\"\n \"setup_wipe.tmp\" was detected as \"Inno Setup Module\" and name: \"Installer\"\n \"setup_wipe.tmp\" was detected as \"Embarcadero Delphi\" and name: \"Compiler\"\n \"setup_wipe.tmp\" was detected as \"Turbo Linker\" and name: \"Linker\"\n \"is-J7Q5K.tmp\" was detected as \"Inno Setup Module\" and name: \"Installer\"\n \"is-J7Q5K.tmp\" was detected as \"Embarcadero Delphi\" and name: \"Compiler\"\n \"is-J7Q5K.tmp\" was detected as \"Turbo Linker\" and name: \"Linker\"\n \"_setup64.tmp\" was detected as \"Inno Setup Module\" and name: \"Installer\"\n \"_setup64.tmp\" was detected as \"Embarcadero Delphi\" and name: \"Compiler\"\n \"_setup64.tmp\" was detected as \"Turbo Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$53","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"setup_wipe.tmp\" (UID: 00000000-00002016) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-8LD9T6N\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"setup_wipe.tmp\" (UID: 00000000-00002016) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$54","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"setup_wipe.tmp\" searching for class \"Shell_TrayWnd\"\n \"Wipe.exe\" searching for class \"EDIT\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"setup_wipe.tmp\" with commandline \"/SL5=\"$60380\n5735482\n185344\nC:\\\\setup_wipe.exe\"\" (UID: 00000000-00002016)\n Spawned process \"Wipe.exe\" with commandline \"uf_sub_runonsetup\" (UID: 00000000-00005796)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"setup_wipe.tmp\" with commandline \"/SL5=\"$60380\n5735482\n185344\nC:\\\\setup_wipe.exe\"\" (UID: 00000000-00002016)\n Spawned process \"Wipe.exe\" with commandline \"uf_sub_runonsetup\" (UID: 00000000-00005796)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 1785808)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US\" (SHA1: 95:B5:F0:2E:48:58:8F:8D:6A:42:6F:AC:5C:85:F8:6B:9D:BD:22:72; see report for more information)\n The input sample is signed with a certificate issued by \"CN=SSL.com Code Signing Intermediate CA ECC R2, O=SSL Corp, L=Houston, ST=Texas, C=US\" (SHA1: B5:EE:4D:A5:8E:C3:60:CC:07:B9:51:08:ED:27:0A:61:0F:B8:FA:0B; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"setup_wipe.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"setup_wipe.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"setup_wipe.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-N65SF.tmp\\setup_wipe.tmp\"\n \"setup_wipe.tmp\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-7MFGP.tmp\\_isetup\\_setup64.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"setup_wipe.tmp\" with commandline \"/SL5=\"$60380\n5735482\n185344\nC:\\\\setup_wipe.exe\"\" (UID: 00000000-00002016)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00002016-1920-908-004B03CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Wipe.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$56","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$57","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"setup_wipe.exe\" queries basic process information of the \"C:\\setup_wipe.exe\" (UID: 7832)\n \"setup_wipe.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-N65SF.tmp\\setup_wipe.tmp\" (UID: 7832)\n \"setup_wipe.tmp\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-N65SF.tmp\\setup_wipe.tmp\" (UID: 2016)\n \"setup_wipe.tmp\" queries basic process information of the \"C:\\Program Files (x86)\\Wipe\\Wipe.exe\" (UID: 2016)\n \"Wipe.exe\" queries basic process information of the \"C:\\Program Files (x86)\\Wipe\\Wipe.exe\" (UID: 5796)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"setup_wipe.exe\" reads file \"c:\\setup_wipe.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00002016.00000002.291608.00513000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$5a","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"Wipe.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Wipe.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"Wipe.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\Desktop\\Wipe.lnk\"\n \"Wipe.exe\" trying to access LNK file \"%USERPROFILE%\\Desktop\\Wipe.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"setup_wipe.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-n65sf.tmp\\setup_wipe.tmp\"\n \"setup_wipe.exe\" writes file \"%temp%\\is-n65sf.tmp\\setup_wipe.tmp\"\n \"setup_wipe.tmp\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\is-7mfgp.tmp\\_isetup\\_setup64.tmp\"\n \"setup_wipe.tmp\" writes file \"c:\\program files (x86)\\wipe\\is-n6fcs.tmp\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; File: \"setup_wipe.exe\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"setup_wipe.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResource\"; File: \"setup_wipe.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; File: \"setup_wipe.exe\")\n Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files using web shell script","description":"Found string \"/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/\" (Indicator: \"HttpWebRequest\"; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-798","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; File: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping \"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"setup_wipe.exe\")\n Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"setup_wipe.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"setup_wipe.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"User chose not to shutdown applications using our files.\" (Indicator: \" shutdown \"; File: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found reference to API \"User chose not to shutdown applications using our files.\" (Indicator: \" shutdown \"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n file/memory contains long string with (Indicator: \" shutdown \"; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"spanish translation maintained by jorge andres brugger (jbrugger@gmx.net)\" [Source: 00000000-00002016.00000000.287768.027F0000.00000004.mdmp\n 00000000-00002016.00000002.291608.027F0000.00000004.mdmp\n 00000000-00002016.00000003.299035.027F0000.00000004.mdmp]\n Observed email domain:\"portuguese translation maintained by nars (nars@gmx.net)\" [Source: 00000000-00002016.00000000.287768.027F0000.00000004.mdmp\n 00000000-00002016.00000002.291608.027F0000.00000004.mdmp\n 00000000-00002016.00000003.299035.027F0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.119.0\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0,\"\n \"192.168.0.2\"\n \"2.5.4.7\"\n \"2.5.4.6\"\n \"2.5.29.19\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.4.3\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.32\"\n \"2.5.29.31\"\n \"2.5.4.8\"\n \"2.5.4.10\"\n \"2.5.29.10\"\n \"2.5.29.37\"\n \"127.0.0.1\"\n \"4.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"ccessibility,4.0.0.0,,b03f5f7f11d50a3a\"\n \"14.0.0.0\"\n \"11.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Ransomware/Banking","name":"Attempts to rename multiple files with a new extension, avoiding critical system files","description":"\"setup_wipe.tmp\" appended encryption extension \".png\" to 10+ files (.tmp)","origin":"API Call","mitre_attack_id":"T1679","relevance":1,"id":"api-325","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00002016.00000000.287768.027F0000.00000004.mdmp, 00000000-00002016.00000001.289686.03EE0000.00000004.mdmp, 00000000-00002016.00000002.291608.027F0000.00000004.mdmp, 00000000-00002016.00000003.299035.027F0000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00005796.00000002.293261.041E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00007832-405-347-0040E170\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00007832-405-348-0040E134\n Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00002016-1920-184-004AD300\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00002016-1920-185-004AD2C4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$60","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"$62","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"setup_wipe.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"function GetUserNameString: String;\" (Indicator: \"GetUserName\"; File: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"setup_wipe.exe\")\n Found reference to API \"function GetUserNameString: String;\" (Indicator: \"GetUserName\"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002016.00000001.289686.7370D000.00000002.mdmp\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00002016.00000002.291608.00513000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$64","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"setup_wipe.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"setup_wipe.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Wipe.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"setup_wipe.tmp\" called \"GetComputerNameW\" (UID: 00000000-00002016)\n \"Wipe.exe\" called \"GetComputerNameW\" (UID: 00000000-00005796)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"setup_wipe.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"Wipe.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"setup_wipe.tmp\" called \"GetUserNameW\" (UID: 00000000-00002016)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$65","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query sqlite firefox history","description":"file/memory contains long string with (Indicator: \"select <> from moz_\"; Source: \"00000000-00005796.00000001.291341.06490000.00000004.mdmp, 00000000-00005796.00000002.293261.06490000.00000004.mdmp, 00000000-00005796.00000003.299067.06490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1217","relevance":1,"id":"string-464","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should Setup place the program's shortcuts?\" (Indicator: \"where \"; Source: \"00000000-00002016.00000000.287768.027F0000.00000004.mdmp, 00000000-00002016.00000001.289686.03EE0000.00000004.mdmp, 00000000-00002016.00000002.291608.027F0000.00000004.mdmp, 00000000-00002016.00000003.299035.027F0000.00000004.mdmp\")\n Found string \"Where should [name] be installed?\" (Indicator: \"where \"; Source: \"00000000-00002016.00000000.287768.027F0000.00000004.mdmp, 00000000-00002016.00000001.289686.03EE0000.00000004.mdmp, 00000000-00002016.00000002.291608.027F0000.00000004.mdmp, 00000000-00002016.00000003.299035.027F0000.00000004.mdmp\")\n Found string \"Where should Wipe be installed?\" (Indicator: \"where \"; Source: \"00000000-00002016.00000001.289686.03EE0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; File: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"setup_wipe.exe\")\n Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00005796.00000002.293261.041E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002016.00000000.287768.736B1000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00002016.00000001.289686.7370D000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$66","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; File: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found string \"Ping failed; helper seems to have died.\" (Indicator: \"ping\"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$67","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinA\" (Source: \"00000000-00005796.00000002.293261.041E2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"Wipe.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005796)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$69","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"setup_wipe.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002016.00000000.287768.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.0050B000.00000004.mdmp, 00000000-00002016.00000001.289686.7370D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"setup_wipe.tmp\" opened \"\\Device\\KsecDD\"\n \"Wipe.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$6c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$6d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"winlogon.exe,smss.exe,csrss.exe,wininit.exe,services.exe\" (Source: \"00000000-00002016.00000003.299035.037E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"setup_wipe.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"setup_wipe.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"setup_wipe.exe\")\n Found reference to API \"procedure CreateMutex(const Name: String);\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002016.00000001.289686.00401000.00000020.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002016.00000001.289686.7370D000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00002016.00000001.289686.7370D000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002016.00000001.289686.7370D000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"setup_wipe.tmp\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections\"- Location: [%TEMP%\\is-N65SF.tmp\\setup_wipe.tmp]- [targetUID: 00000000-00002016]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"- Location: [%TEMP%\\is-7MFGP.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00002016]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetLongPathNameW\" (Source: setup_wipe.exe, API is part of module: KERNELBASE.DLL)\n Found string \"SetDefaultDllDirectories\" (Source: setup_wipe.exe, API is part of module: KERNELBASE.DLL)\n Found string \"SetDllDirectoryW\" (Source: setup_wipe.exe, API is part of module: KERNEL32.DLL)\n Found string \"SetSearchPathMode\" (Source: setup_wipe.exe, API is part of module: KERNEL32.DLL)\n Found string \"SetProcessDEPPolicy\" (Source: setup_wipe.exe, API is part of module: KERNEL32.DLL)\n Found string \"GetDiskFreeSpaceExW\" (Source: setup_wipe.exe, API is part of module: KERNELBASE.DLL)\n Found string \"GetUserDefaultUILanguage\" (Source: setup_wipe.exe, API is part of module: KERNELBASE.DLL)\n Found string \"Wow64DisableWow64FsRedirection\" (Source: setup_wipe.exe, API is part of module: KERNELBASE.DLL)\n Found string \"Wow64RevertWow64FsRedirection\" (Source: setup_wipe.exe, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"setup_wipe.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"setup_wipe.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"setup_wipe.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"REGFILES0000\"; Value: \"%PROGRAMFILES%\\(x86)\\Wipe\\Wipe.exe\"), \"setup_wipe.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WIPE_IS1\"; Key: \"DISPLAYICON\"; Value: \"%PROGRAMFILES%\\(x86)\\Wipe\\unins000.exe\"), \"setup_wipe.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WIPE_IS1\"; Key: \"UNINSTALLSTRING\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Wipe\\unins000.exe\"\"), \"setup_wipe.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\WIPE_IS1\"; Key: \"QUIETUNINSTALLSTRING\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Wipe\\unins000.exe\" /SILENT\"), \"Wipe.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WIPE UPDATES\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Wipe\\Wipe.exe\" uf_sub_winStartup\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Wipe.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5796)","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"Wipe.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"e002430435010000\"\n \"szProvider\": \"Microsoft Enhanced RSA and AES Cryptographic Provider\"\n \"dwProvType\": \"24\"\n \"dwFlags\": \"4026531840\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"$6e","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00000000-00007832-405-382-0040EE2C\n FindResourceW@KERNEL32.DLL at 00000000-00002016-1920-416-00423154\n FindResourceW@KERNEL32.DLL at 00000000-00002016-1920-463-00426AE4\n FindResourceW@KERNEL32.DLL at 00000000-00002016-1920-2812-0040AA2C\n FreeResource@KERNEL32.DLL at 00000000-00002016-1920-7532-00426B50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"Wipe.exe\" reads file \"C:\\Program Files (x86)\\Wipe\\Framework\\Interface\\colors.ini\"\n \"Wipe.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\wipe2021\\Settings\\UF.ini\"\n \"Wipe.exe\" reads file \"C:\\Program Files (x86)\\desktop.ini\"\n \"Wipe.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Wipe.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"Wipe.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"Wipe.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"Wipe.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"Wipe.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"Wipe.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"setup_wipe.tmp\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections\"- Location: [%TEMP%\\is-N65SF.tmp\\setup_wipe.tmp]- [targetUID: 00000000-00002016]\n \"is-J7Q5K.tmp\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 Mono/.Net assembly 2 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Wipe\\is-J7Q5K.tmp]- [targetUID: 00000000-00002016]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"- Location: [%TEMP%\\is-7MFGP.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00002016]\n \"is-N6FCS.tmp\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 8 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Wipe\\is-N6FCS.tmp]- [targetUID: 00000000-00002016]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"Wipe.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WIPE UPDATES\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Wipe\\Wipe.exe\" uf_sub_winStartup\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$6f","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"is-J7Q5K.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"$70","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$71","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"System Destruction","name":"Contains ability to remove directories","description":"RemoveDirectoryW@kernel32.dll at 65262-1712-00411D17\n RemoveDirectoryW@kernel32.dll at 65262-1714-00406804\n RemoveDirectoryW@KERNEL32.DLL at 00000000-00007832-405-493-00411D17\n RemoveDirectoryW@KERNEL32.DLL at 00000000-00002016-1920-183-004AD9B4\n RemoveDirectoryW@KERNEL32.DLL at 00000000-00002016-1920-1073-004D2C84","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.004","relevance":3,"id":"stream-109","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00002016-1920-3403-0044AAD0\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00002016-1920-3502-00453668\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00002016-1920-3656-004608E0\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00002016-1920-4063-0047B4B4\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00002016-1920-4071-0047BCA0\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00002016-1920-4074-0047BDA4\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00002016-1920-4107-004814CC\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00002016-1920-4491-004B26C4\n NtdllDefWindowProc_W@NTDLL.DLL at 00000000-00002016-1920-4857-004DAB10","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"setup_wipe.exe\" wrote 000011C0 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-N65SF.tmp\\setup_wipe.tmp\" (Handle: 580)\n \"setup_wipe.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\is-N65SF.tmp\\setup_wipe.tmp\" (Handle: 580)\n \"setup_wipe.tmp\" wrote 000011C0 bytes to a remote process \"C:\\Program Files (x86)\\Wipe\\Wipe.exe\" (Handle: 1156)\n \"setup_wipe.tmp\" wrote 00000008 bytes to a remote process \"C:\\Program Files (x86)\\Wipe\\Wipe.exe\" (Handle: 1156)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]}],"intel_graph":{"map":{"File:03ca26319e797216302879bd8e417d94f54c9b5b2470319c39cdd7bb5e51e868":{"type":"File","value":"03ca26319e797216302879bd8e417d94f54c9b5b2470319c39cdd7bb5e51e868","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:169022c9d96974ef372e43310a9bef6c92f25ae78e4688c8b7d040ca8fd2540b":{"type":"File","value":"169022c9d96974ef372e43310a9bef6c92f25ae78e4688c8b7d040ca8fd2540b"},"File:23ac90c6a3ed32c8a0ba45dd589f78aac1fa44aaad34ea2c3aed034b24dd7cb9":{"type":"File","value":"23ac90c6a3ed32c8a0ba45dd589f78aac1fa44aaad34ea2c3aed034b24dd7cb9"},"File:26f80365e4b4145edf0c4ed9c7fd50c4c46aac3e379b21da16f391b071e79891":{"type":"File","value":"26f80365e4b4145edf0c4ed9c7fd50c4c46aac3e379b21da16f391b071e79891"},"File:3bb44122f66cb74d3e32b8649446c0af2b084c9257525f13cc9d9d138037f7f5":{"type":"File","value":"3bb44122f66cb74d3e32b8649446c0af2b084c9257525f13cc9d9d138037f7f5"},"File:49d58e29a4034091ccf0822acdc0f537ec3101f16557cc58a8717a7d75e1436a":{"type":"File","value":"49d58e29a4034091ccf0822acdc0f537ec3101f16557cc58a8717a7d75e1436a"},"File:4bb9a6b97bce9b93787d194d64389de2b04c560ece8b87053b4d3c8597c4d2d1":{"type":"File","value":"4bb9a6b97bce9b93787d194d64389de2b04c560ece8b87053b4d3c8597c4d2d1"},"File:577cb21b3052599fcf154e2d66eb677383daf31b9169748c62982fef92b72dc2":{"type":"File","value":"577cb21b3052599fcf154e2d66eb677383daf31b9169748c62982fef92b72dc2"},"File:6bf9784c54419a8f3af7960b3647c9a84a2be91505d4e87cdce1a1c6fdc5bfc2":{"type":"File","value":"6bf9784c54419a8f3af7960b3647c9a84a2be91505d4e87cdce1a1c6fdc5bfc2"},"File:84340f88bd283aaf7d65d6cbfee3d368fa4e71fa46e389b1e73815a355f96706":{"type":"File","value":"84340f88bd283aaf7d65d6cbfee3d368fa4e71fa46e389b1e73815a355f96706"},"File:8da70471b37bdcfe50676936c381357dbe15c48a057cbc609fa56d79c4527ee8":{"type":"File","value":"8da70471b37bdcfe50676936c381357dbe15c48a057cbc609fa56d79c4527ee8"},"File:a00e4b778ad2746db66ec57039d56b4eb31aca35f18f613af8004c717c66be49":{"type":"File","value":"a00e4b778ad2746db66ec57039d56b4eb31aca35f18f613af8004c717c66be49"},"File:b046d306be1dfe0d13fd018d8958b19cd3e864ec49a691df4375868bedf58117":{"type":"File","value":"b046d306be1dfe0d13fd018d8958b19cd3e864ec49a691df4375868bedf58117","verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:c4cadc13ab5aff528b3735b1bdd90511b9a8882ba8e0a76f00cd50976b35088a":{"type":"File","value":"c4cadc13ab5aff528b3735b1bdd90511b9a8882ba8e0a76f00cd50976b35088a"},"File:caeac8d60d9ef785de468786d0ee7a736f530c6497e33858cf164a8a95c73321":{"type":"File","value":"caeac8d60d9ef785de468786d0ee7a736f530c6497e33858cf164a8a95c73321"},"File:d4864c342f87a2ef5b6ac2a1b2720dbece46ea2184c878c68a7029ea469e485d":{"type":"File","value":"d4864c342f87a2ef5b6ac2a1b2720dbece46ea2184c878c68a7029ea469e485d"},"File:db8d7f4f68439e29e51a22cc364dd0c1271f74011c4608547a2a5780f6fbe4af":{"type":"File","value":"db8d7f4f68439e29e51a22cc364dd0c1271f74011c4608547a2a5780f6fbe4af"},"File:dcc08080e45ae7bd13d83535ad0021d7f1d5eae41653679349fd4afbaa24989a":{"type":"File","value":"dcc08080e45ae7bd13d83535ad0021d7f1d5eae41653679349fd4afbaa24989a"},"File:f4d4e40f77ea0fda7ceee4f3615a91e52d9842e0c975903758fc84ef1829d67d":{"type":"File","value":"f4d4e40f77ea0fda7ceee4f3615a91e52d9842e0c975903758fc84ef1829d67d"},"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c":{"type":"File","value":"f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f79fba5b6efa15fcd45d0b7d58808a02ead5ed8a36d75de04d17997d0373da89":{"type":"File","value":"f79fba5b6efa15fcd45d0b7d58808a02ead5ed8a36d75de04d17997d0373da89"},"File:f7a4d439138bf091958ca087ca98e21bb8d59fd7d6ff3c9704f1f55d8c7dfecc":{"type":"File","value":"f7a4d439138bf091958ca087ca98e21bb8d59fd7d6ff3c9704f1f55d8c7dfecc"},"File:fd598a08faa6191cc3c040bf966807027b9da9b32d55244b687747c3abc58a1d":{"type":"File","value":"fd598a08faa6191cc3c040bf966807027b9da9b32d55244b687747c3abc58a1d"}},"chains":[{"id":"1568053677432483876","root":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:03ca26319e797216302879bd8e417d94f54c9b5b2470319c39cdd7bb5e51e868"}],"verdict":{"verdict":"unknown"}},{"id":"1568053677499592742","root":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","edges":[{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:b046d306be1dfe0d13fd018d8958b19cd3e864ec49a691df4375868bedf58117"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","edges":[{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:b046d306be1dfe0d13fd018d8958b19cd3e864ec49a691df4375868bedf58117"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:03ca26319e797216302879bd8e417d94f54c9b5b2470319c39cdd7bb5e51e868"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:26f80365e4b4145edf0c4ed9c7fd50c4c46aac3e379b21da16f391b071e79891"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:dcc08080e45ae7bd13d83535ad0021d7f1d5eae41653679349fd4afbaa24989a"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:84340f88bd283aaf7d65d6cbfee3d368fa4e71fa46e389b1e73815a355f96706"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:169022c9d96974ef372e43310a9bef6c92f25ae78e4688c8b7d040ca8fd2540b"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:caeac8d60d9ef785de468786d0ee7a736f530c6497e33858cf164a8a95c73321"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:f79fba5b6efa15fcd45d0b7d58808a02ead5ed8a36d75de04d17997d0373da89"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:fd598a08faa6191cc3c040bf966807027b9da9b32d55244b687747c3abc58a1d"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:3bb44122f66cb74d3e32b8649446c0af2b084c9257525f13cc9d9d138037f7f5"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:db8d7f4f68439e29e51a22cc364dd0c1271f74011c4608547a2a5780f6fbe4af"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:6bf9784c54419a8f3af7960b3647c9a84a2be91505d4e87cdce1a1c6fdc5bfc2"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:8da70471b37bdcfe50676936c381357dbe15c48a057cbc609fa56d79c4527ee8"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:4bb9a6b97bce9b93787d194d64389de2b04c560ece8b87053b4d3c8597c4d2d1"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:a00e4b778ad2746db66ec57039d56b4eb31aca35f18f613af8004c717c66be49"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:d4864c342f87a2ef5b6ac2a1b2720dbece46ea2184c878c68a7029ea469e485d"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:f4d4e40f77ea0fda7ceee4f3615a91e52d9842e0c975903758fc84ef1829d67d"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:49d58e29a4034091ccf0822acdc0f537ec3101f16557cc58a8717a7d75e1436a"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:577cb21b3052599fcf154e2d66eb677383daf31b9169748c62982fef92b72dc2"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:f7a4d439138bf091958ca087ca98e21bb8d59fd7d6ff3c9704f1f55d8c7dfecc"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:23ac90c6a3ed32c8a0ba45dd589f78aac1fa44aaad34ea2c3aed034b24dd7cb9"},{"edge_kind":"extracted","from_key":"File:f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","to_key":"File:c4cadc13ab5aff528b3735b1bdd90511b9a8882ba8e0a76f00cd50976b35088a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":24,"imported_dlls_count":117,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":191,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["yandex","evasive"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6aed199c67251d422206b2f1","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"submit_name":"setup_wipe.exe","analysis_start_time":"2026-11-06T00:04:46+00:00","indicators_count":{"informative":236,"suspicious":60,"malicious":1},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}],"processes":[{"pid":7832,"ppid":0,"name":"setup_wipe.exe","command_line":"","sha256":"f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c","normalized_path":"C:\\setup_wipe.exe","uid":"00000000-00007832","icon":"$72"},{"pid":2016,"ppid":7832,"name":"setup_wipe.tmp","command_line":"/SL5=\"$60380,5735482,185344,C:\\setup_wipe.exe\"","sha256":"ebea872ddbe04ca31f725ea820b95acc5dd84d69ad8ae32a4e95000c2b334916","normalized_path":"%TEMP%\\is-N65SF.tmp\\setup_wipe.tmp","parent_uid":"00000000-00007832","uid":"00000000-00002016"},{"pid":5796,"ppid":2016,"name":"Wipe.exe","command_line":"uf_sub_runonsetup","sha256":"7468acff59e9e8f20d14c0fe95574d105c7baf3dad973c174c1cc3dacf737ca2","normalized_path":"%PROGRAMFILES%\\(x86)\\Wipe\\Wipe.exe","parent_uid":"00000000-00002016","uid":"00000000-00005796"}],"all_imported_dlls":["CoreUIComponents.dll","msftedit.dll","globinputhost.dll","vcruntime140_clr0400.dll","uxtheme.dll","sfc_os.dll","vcruntime140_1.dll","imagehlp.dll","UIAutomationCore.dll","msvcrt.dll","ws2_32.dll","cryptbase.dll","shfolder.dll","msasn1.dll","combase.dll","comctl32.dll","CoreMessaging.dll","System.Core.ni.dll","wbemcomn.dll","gdi32.dll","imm32.dll","apphelp.dll","ncrypt.dll","amsi.dll","scrrun.dll","linkinfo.dll","ole32.dll","clr.dll","TextShaping.dll","tiptsf.dll","srvcli.dll","wow64con.dll","win32u.dll","bcryptprimitives.dll","setupapi.dll","VxSSL64.dll","psapi.dll","System.Drawing.ni.dll","oleacc.dll","advapi32.dll","user32.dll","gdi32full.dll","System.Management.ni.dll","Accessibility.ni.dll","sxs.dll","System.Xml.ni.dll","msctf.dll","msvcp140.dll","WinTypes.dll","Microsoft.VisualBasic.ni.dll","Windows.Globalization.dll","vcruntime140_1_clr0400.dll","msi.dll","System.Windows.Forms.ni.dll","wbemsvc.dll","T9mBWm7f.dll","cscapi.dll","shell32.dll","BCP47Langs.dll","ServicingCommon.dll","DWrite.dll","ucrtbase.dll","rpcrt4.dll","version.dll","ExplorerFrame.dll","clrjit.dll","rsaenh.dll","WMINet_Utils.dll","cfgmgr32.dll","wow64.dll","vcruntime140.dll","windows.storage.dll","mscoree.dll","mscoreei.dll","userenv.dll","ntdll.dll","wow64win.dll","fltLib.dll","MpOAV.dll","wow64cpu.dll","VxSSL32.dll","TextInputFramework.dll","RstrtMgr.dll","GdiPlus.dll","fastprox.dll","SHCore.dll","kernel.appcore.dll","wow64base.dll","KernelBase.dll","msvcp_win.dll","mscorlib.ni.dll","sechost.dll","System.Configuration.ni.dll","ucrtbase_clr0400.dll","kernel32.dll","shlwapi.dll","wbemprox.dll","oleaut32.dll","dwmapi.dll","cryptsp.dll","msimg32.dll","ntasn1.dll","propsys.dll","System.ni.dll","crypt32.dll","clbcatq.dll","sfc.dll","System.Runtime.Remoting.ni.dll","wintrust.dll","profapi.dll","Windows.UI.dll","comdlg32.dll","mpr.dll","bcrypt.dll","sspicli.dll","ntshrui.dll","wmiutils.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"data/not-IsWin64/{app}/Wipe.exe","sha256":"b046d306be1dfe0d13fd018d8958b19cd3e864ec49a691df4375868bedf58117","verdict":"suspicious","sources":[{"report_type":"qsp","report_id":""}]},{"name":"03ca26319e797216302879bd8e417d94f54c9b5b2470319c39cdd7bb5e51e868","sha256":"03ca26319e797216302879bd8e417d94f54c9b5b2470319c39cdd7bb5e51e868","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"is-0DT3Q.tmp","sha256":"26f80365e4b4145edf0c4ed9c7fd50c4c46aac3e379b21da16f391b071e79891","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-165JH.tmp","sha256":"dcc08080e45ae7bd13d83535ad0021d7f1d5eae41653679349fd4afbaa24989a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-2CKPJ.tmp","sha256":"84340f88bd283aaf7d65d6cbfee3d368fa4e71fa46e389b1e73815a355f96706","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-4N847.tmp","sha256":"169022c9d96974ef372e43310a9bef6c92f25ae78e4688c8b7d040ca8fd2540b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-9HVTD.tmp","sha256":"caeac8d60d9ef785de468786d0ee7a736f530c6497e33858cf164a8a95c73321","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-JS9LR.tmp","sha256":"f79fba5b6efa15fcd45d0b7d58808a02ead5ed8a36d75de04d17997d0373da89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-ND52V.tmp","sha256":"fd598a08faa6191cc3c040bf966807027b9da9b32d55244b687747c3abc58a1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-Q712A.tmp","sha256":"3bb44122f66cb74d3e32b8649446c0af2b084c9257525f13cc9d9d138037f7f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-R4QNF.tmp","sha256":"db8d7f4f68439e29e51a22cc364dd0c1271f74011c4608547a2a5780f6fbe4af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-UL0KF.tmp","sha256":"6bf9784c54419a8f3af7960b3647c9a84a2be91505d4e87cdce1a1c6fdc5bfc2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-5OEKB.tmp","sha256":"8da70471b37bdcfe50676936c381357dbe15c48a057cbc609fa56d79c4527ee8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-A5GPD.tmp","sha256":"4bb9a6b97bce9b93787d194d64389de2b04c560ece8b87053b4d3c8597c4d2d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-B7GS7.tmp","sha256":"a00e4b778ad2746db66ec57039d56b4eb31aca35f18f613af8004c717c66be49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-BTN4O.tmp","sha256":"d4864c342f87a2ef5b6ac2a1b2720dbece46ea2184c878c68a7029ea469e485d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-I5BEL.tmp","sha256":"f4d4e40f77ea0fda7ceee4f3615a91e52d9842e0c975903758fc84ef1829d67d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-K1EIQ.tmp","sha256":"49d58e29a4034091ccf0822acdc0f537ec3101f16557cc58a8717a7d75e1436a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-N7OI7.tmp","sha256":"577cb21b3052599fcf154e2d66eb677383daf31b9169748c62982fef92b72dc2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-NA1FV.tmp","sha256":"f7a4d439138bf091958ca087ca98e21bb8d59fd7d6ff3c9704f1f55d8c7dfecc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-QBFD2.tmp","sha256":"23ac90c6a3ed32c8a0ba45dd589f78aac1fa44aaad34ea2c3aed034b24dd7cb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"is-QT0RN.tmp","sha256":"c4cadc13ab5aff528b3735b1bdd90511b9a8882ba8e0a76f00cd50976b35088a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%TEMP%\\is-N65SF.tmp\\setup_wipe.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%TEMP%\\is-7MFGP.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\is-N6FCS.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\is-J7Q5K.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\is-3PGUI.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\is-UEFDI.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\is-DVEJO.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\is-50KQU.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\is-TKF84.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\is-CE3OB.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\is-RL4GM.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\is-N9JEL.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\is-2ITPL.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\is-9DNQT.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\is-831KF.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\FunStarts\\is-UL0KF.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\FunStarts\\is-JS9LR.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\FunStarts\\is-ND52V.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\FunStarts\\is-0DT3Q.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\FunStarts\\is-4N847.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\FunStarts\\is-165JH.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\FunStarts\\is-Q712A.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\FunStarts\\is-R4QNF.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\FunStarts\\is-2CKPJ.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\FunStarts\\is-9HVTD.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-I5BEL.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-B7GS7.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-5OEKB.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-N7OI7.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-T6S1P.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-K1EIQ.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-RCOO8.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-BTN4O.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-A5GPD.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-NA1FV.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-QBFD2.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Languages\\is-QT0RN.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-HDRNA.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-UPRSF.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-QG5UG.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-MJEHT.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-ENH17.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-B4QL1.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-4J4SA.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-V22M1.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-VEL0T.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-P9BAD.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-JL7Q9.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-6OVAS.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-GUA43.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-O4I1D.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-74RG5.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-BFS76.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-IBUSI.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-FRFIM.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-DBRPL.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-8BSLL.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-5JS01.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-497B2.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-LMHMH.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-F25L4.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-IMI89.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-425B9.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-23HAI.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-T7JO9.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-978J1.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-TS482.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-NCNTG.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-BTH5S.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-3BA22.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-TBJA6.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-JP9R2.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-UBBOM.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-5QJR3.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-P5SEC.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-R8GJ0.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-TLAVE.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-0H37S.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-3OA5C.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-H5OP3.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-N05ST.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-R13M7.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-O4DJV.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-ULG52.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-PHP7Q.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-0MSNP.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-4H4IT.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-DB3IM.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-PUTAU.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-7T02D.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-S0VET.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-5NT1N.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-8LS50.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-NHNFO.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-0T78O.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-931LS.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-GM78P.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-MTITL.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-163L5.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-5QFMT.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-S5DT1.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-QQMDP.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-6O0SS.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-ECSGJ.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-4GISE.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-BT85U.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-4LLSM.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-1SIIM.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-RB2LR.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-9CUFS.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-J7A5B.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-TRFGT.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-1Q9BU.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-JVDPA.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-JURRI.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-P0230.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-BU8LF.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-K3MK1.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-VH5O4.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-E384O.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-L7DT7.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-NEJLO.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-6K57O.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-6NCLT.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-K981T.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-8O7O8.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-NI0B6.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-T85Q6.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-2PTMA.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-DQBP8.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-21BN7.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-LJIPB.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-NF315.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-UVSQH.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-QIGKJ.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-KBPV5.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-N7FT7.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-JLA1Q.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-71J01.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-3I6RC.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-BHLP8.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-7A2OS.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-5TNAA.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-SR81M.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-IVLNU.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-2J4DE.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-9L8O5.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-OBD9U.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-9NMG4.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-RU8H9.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-9MV2A.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-7T5FQ.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-FHQCG.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-B6IQ4.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-IO4LI.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-DVSJ2.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-OILBQ.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-JPV1O.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-7FSIL.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-7VPNF.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-UJ30R.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-GVF5S.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-BN8EA.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-B6T4P.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-G4SIA.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-NEP89.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-QUEHA.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-S6U6N.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-34ER0.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-88LEM.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-K6VOC.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-FS9D1.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-O7G9K.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-O0C2S.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-CITK8.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-DPUBG.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-4ON0V.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-M63II.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%PROGRAMFILES%\\(x86)\\Wipe\\Application\\Plugins\\is-1P09O.tmp","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%ALLUSERSPROFILE%\\HardwareTelemetry2b.bin","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%APPDATA%\\wipe2021\\Settings\\UF.ini","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"path":"%USERPROFILE%\\Desktop\\Wipe.lnk","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7832:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7832:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"Local\\SM0:7832:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"SM0:7832:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2016:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2016:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2016:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2016:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"Local\\SM0:2016:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"SM0:2016:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"Local\\SM0:2016:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"SM0:2016:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5796:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"SM0:5796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"SM0:5796:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"Local\\SM0:5796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"Local\\SM0:5796:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5796:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5796:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aed199c67251d422206b2f1"}]}]}},"report_ids":{"sandbox_job_ids":["6aed199c67251d422206b2f1"]}}}]]}] 2c:[["$","title","0",{"children":"Suspicious Sample f76a62d3f2a5… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample f76a62d3f2a5…. Threat score 70/100. 0/24 AV engines flagged this file. 1 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample f76a62d3f2a5… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample f76a62d3f2a5…. Threat score 70/100. 0/24 AV engines flagged this file. 1 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f76a62d3f2a59628f5d53969c887049e221317019a4492b4336e7d6ea0f0466c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample f76a62d3f2a5… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample f76a62d3f2a5…. Threat score 70/100. 0/24 AV engines flagged this file. 1 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L73","11",{}]] 32:null