26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T428,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 015151bd2d2b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 015151bd2d2b…. Threat score 100/100. 0/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925"],"about":{"@type":"SoftwareApplication","name":"bounty-43461097661075379","applicationCategory":["msi","data"],"identifier":"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T919,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")28:Ta72,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcessToken"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcessToken"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")29:Ta72,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000001.87884.6ED91000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ED91000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")2a:Tdbd,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")2b:Tc87,Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")2c:T808,file/memory contains long string with (Indicator: "RC2"; Source: "00000000-00005880-00000C94-197514480") file/memory contains long string with (Indicator: "Aes"; Source: "00000000-00005880-00000C91-197621949") file/memory contains long string with (Indicator: "Aes"; Source: "00000000-00005880-00000C94-197643869") file/memory contains long string with (Indicator: "Aes"; Source: "00000000-00005880.00000001.87884.07BF0000.00000004.mdmp, 00000000-00005880.00000002.89813.07BF0000.00000004.mdmp") file/memory contains long string with (Indicator: "Oid"; Source: "00000000-00005880.00000001.87884.07BF0000.00000004.mdmp, 00000000-00005880.00000002.89813.07BF0000.00000004.mdmp") file/memory contains long string with (Indicator: "RC2"; Source: "00000000-00005880.00000001.87884.07BF0000.00000004.mdmp, 00000000-00005880.00000002.89813.07BF0000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to "KeySizes" (Indicator: "KeySizes"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to "LegalKeySizesValue" (Indicator: "KeySizes"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to "LA8LSVgrsZpJGD0yMAes" (Indicator: "Aes"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to "GKaTCOeAes" (Indicator: "Aes"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp")2d:T664,Found PE header "MZ" - Source: "00000000-00005476.00000000.92589.006E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005720.00000000.79228.DEB80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005720.00000001.81150.DEB80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005720.00000002.83068.DEB80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005880.00000000.87037.00BC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005880.00000001.87884.00BC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005880.00000001.87884.07BF0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005880.00000001.87884.6ECF0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005880.00000001.87884.6ED90000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005880.00000002.89813.00BC0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005880.00000002.89813.07BF0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005880.00000002.89813.6ECF0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00005880.00000002.89813.6ED90000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006972.00000000.79144.DEB80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006972.00000001.81067.DEB80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006972.00000002.82984.DEB80000.00000002.mdmp")2e:T13e4,"EXPAND.EXE" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006696) "Bpznb.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000004147b39c2318397260272f01687d327700f62f0190473972ed5ca6effeffffff1cf52f0171433872c0f42f0100008675b8f52f018a433872e0df5c7508000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff340000000000000048f52f0100000000080000000000000000000000000000000000000000000000000086756947b39c0000000088f52f0169928c74ffffffff3400000048f52f01080000000000000000008675b8f52f0127948c7450f52f010b00000000000000a0f52f01 (UID: 00000000-00005880) "Bpznb.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005880) "Bpznb.exe" called "RtlGetVersion" (UID: 00000000-00005880) "Bpznb.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005880) "Bpznb.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000028cf2f01ccce2f01226e427500003b05000000002d6e4275a987a1512d000000ecb7ed7550cf2f010b000000186d5f0338745e030f0000008000000090ce2f010000f50014cf2f0170c843759d38c625feffffff2d000000d0ccfc7527000000e4ce2f01856a44751c23497524cf2f01f85f447508000000bb694375b26943754186a1512d000000ecb7ed7527000000d0ccfc75f8ce2f012d000000d0ccfc752700000028cf2f01856a44751c23497570cf2f017e8afb75ee8cfb75738afb75b00637fc2d000000ecb7ed7527000000d0ccfc7504283b0598273b05b00637fc38cf2f01fc52397624d02f01e084fb75f8382f8bfeffffff738afb75 (UID: 00000000-00005880) "Bpznb.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ac77e089a007e089a00700000000603a3b0588819f07b880a0072900000098819f0746003e0050f5ac7758729f0758729f07000000003197a151d0723b0518659f0726000000e0723b050d00240050f5ac778838a0078838a00700000000e089a007c0809f071838a00702000000d0809f07030002000008340564000000f997a15158729f0758729f0700000000feffffff84704275c8de2f016570427500003b050000000084704275ad97a1518838a0078838a00700000000e32ed46e58729f07b5ced06e91db937c90de2f01176fd16e24df2f0170c84375453bc625feffffff847042750a8ed36e8838a007f08dd36ef0de2f01a7ced06e01000000 (UID: 00000000-00005880) "Bpznb.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ac779088a0079088a007000000000000000088819f07b880a0072300000050f5ac77c0749f07c0749f070000000084704275d0723b0518659f072d000000e0723b050d002a00a80b34056400000050f5ac778838a0078838a007000000009088a007c0809f071838a00702000000d0809f07030002000008340564000000c0749f07c0749f0700000000feffffff84704275c4de2f016570427500003b050000000084704275a197a1518838a0078838a00700000000e32ed46ec0749f07b5ced06e8ddb937c8cde2f01176fd16e24df2f0170c84375453bc625feffffff847042750a8ed36e8838a007f08dd36eecde2f01a7ced06e01000000504bd16e (UID: 00000000-00005880) "Bpznb.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005880)2f:T620,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000001.87884.6ED91000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ED91000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")30:T6dc,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")31:T5aa,"msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "MsiExec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "MsiExec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ICACLS.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "EXPAND.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Bpznb.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Bpznb.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")32:T514,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")33:T499,Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp")34:T620,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000001.87884.6ED91000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ED91000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")35:T436,Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")36:T1bb1,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "" (Indicator: "GetVersionExA"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersionExW"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "PRINT,NS_VistaRTMVersionLie::APIHook_RtlGetVersion,174,[ApiName] Hook Entered" (Indicator: "GetVersion"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "" (Indicator: "GetVersionExA"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersionExW"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "PRINT,NS_VistaRTMVersionLie::APIHook_RtlGetVersion,174,[ApiName] Hook Entered" (Indicator: "GetVersion"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")37:T3d7e,"msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter srpapi.dll (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TSAPPCMP.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHLWAPI.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHELL32.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\WLDP.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\sxs.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCOREE.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\fusion.dll (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTDLL.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter MsiHnd.dll (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PCACLI.DLL (UID: 00000000-00006972) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TSAPPCMP.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHLWAPI.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SRCLIENT.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\WLDP.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCOREE.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\fusion.dll (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\sxs.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RSTRTMGR.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHELL32.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTDLL.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PCACLI.DLL (UID: 00000000-00005720) "msiexec.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005720) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005368) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005368) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005368) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005368) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00005368) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005368) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\OLE32.DLL (UID: 00000000-00005368) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00005368) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00005368) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\RPCRT4.DLL (UID: 00000000-00005368) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\ADVAPI32.DLL (UID: 00000000-00005368) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\KERNEL32.DLL (UID: 00000000-00005368) "ICACLS.EXE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005988) "ICACLS.EXE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005988) "ICACLS.EXE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005988) "ICACLS.EXE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005988) "EXPAND.EXE" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006696) "EXPAND.EXE" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006696) "EXPAND.EXE" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006696) "EXPAND.EXE" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006696) "EXPAND.EXE" called "LoadLibrary" with a parameter Expand.exe (UID: 00000000-00006696) "EXPAND.EXE" called "LoadLibrary" with a parameter dpx.dll (UID: 00000000-00006696) "EXPAND.EXE" called "LoadLibrary" with a parameter wdscore.dll (UID: 00000000-00006696) "EXPAND.EXE" called "LoadLibrary" with a parameter api-ms-win-core-version-l1-1-1 (UID: 00000000-00006696) "EXPAND.EXE" called "LoadLibrary" with a parameter api-ms-win-core-psapi-l1-1-0.dll (UID: 00000000-00006696) "Bpznb.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005880) "Bpznb.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005476) "Bpznb.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005476) "Bpznb.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005476) "Bpznb.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005476) "Bpznb.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005476) "Bpznb.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005476)38:Tfca2,"msiexec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter ResolveDelayLoadsFromDll (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SrpOpenTrackInstall (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SrpCloseTrackInstall (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SHGetPropertyStoreForWindow (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SaferiChangeRegistryScope (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SaferGetLevelInformation (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter ApphelpGetMsiProperties (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SdbInitDatabase (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SdbFindFirstMsiPackage_Str (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SdbReleaseDatabase (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CheckElevationEnabled (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter InitCommonControls (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter ImageList_Create (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter ImageList_ReplaceIcon (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter ImageList_Destroy (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter PcaNotifyMsiInstall (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006972) "msiexec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateWaitableTimerW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CancelWaitableTimer (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CoImpersonateClient (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CoRevertToSelf (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter QueryInstanceCount (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CoGetCallContext (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateEnvironmentBlock (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter DestroyEnvironmentBlock (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SRSetRestorePointW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SaferiChangeRegistryScope (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SaferGetLevelInformation (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SetMSIHandleForLogging (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter InitializeFusion (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetCachePath (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateApplicationContext (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateAssemblyCache (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateInstallReferenceEnum (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateHistoryReader (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter LookupHistoryAssembly (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetHistoryFileDirectory (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter InstallCustomModule (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter PreBindAssembly (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter PreBindAssemblyEx (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter NukeDownloadedCache (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter ClearDownloadCache (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CopyPDBs (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter ApphelpGetMsiProperties (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SdbInitDatabase (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SdbFindFirstMsiPackage_Str (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SdbReleaseDatabase (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CheckElevationEnabled (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter PcaNotifyMsiInstall (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter StgCreateStorageEx (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter RtlImageNtHeaderEx (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CreateRestrictedToken (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00005720) "msiexec.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00005720) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005368) "MsiExec.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005368) "ICACLS.EXE" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005988) "ICACLS.EXE" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005988) "EXPAND.EXE" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter EtwEventRegister (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter EtwEventUnregister (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter EtwEventEnabled (UID: 00000000-00006696) "EXPAND.EXE" called "GetProcAddress" with a parameter EtwEventWrite (UID: 00000000-00006696) "Bpznb.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry_RetAddr (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00005880) "Bpznb.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter OpenEventA (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetUserDefaultLangID (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00005476) "Bpznb.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00005476)39:T662,Found reference to native API (Indicator: "VerSetConditionMask"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to native API (Indicator: "RtlUnwind"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to native API (Indicator: "RtlCaptureContext"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to native API (Indicator: "VerSetConditionMask"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to native API (Indicator: "RtlUnwind"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to native API (Indicator: "RtlGetVersion"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to native API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to native API (Indicator: "RtlCaptureContext"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")3a:T1433,"SELECT `Data` FROM `Binary` WHERE `Name` = '%s'" (Source: 015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin, Indicator: "select `data` from `binary` where `name` = '%s'") "SELECT `Data` FROM `Binary` WHERE `Name`='bz.CustomActionDll'" (Source: 00000000-00005720.00000000.79228.11164000.00000004.mdmp, 00000000-00005720.00000001.81150.11164000.00000004.mdmp, 00000000-00005720.00000002.83068.11164000.00000004.mdmp, Indicator: "select `data` from `binary` where `name`='bz.customactiondll'") "SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` > 0 ORDER BY `Sequence`" (Source: 00000000-00005720.00000000.79228.11164000.00000004.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.11164000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.11164000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp, Indicator: "select `action`,null,`condition` from `installexecutesequence` where `sequence` > 0 order by `sequence`") "SELECT * FROM #_MsiRedirectedFile WHERE `Sequence` IS NOT NULL ORDER BY `Sequence`" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp, Indicator: "select * from #_msiredirectedfile where `sequence` is not null order by `sequence`") "SELECT `FileName`,`Version`,`State`,`File`.`Attributes`,`TempAttributes`,`File`,`FileSize`,`Language`,`Sequence`,`Directory_`,`Installed`,`Action`,`Component` FROM `File`,`Component` WHERE `Component`=`Component_` AND `Component_`=? AND `Directory_`=?" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp, Indicator: "select `filename`,`version`,`state`,`file`.`attributes`,`tempattributes`,`file`,`filesize`,`language`,`sequence`,`directory_`,`installed`,`action`,`component` from `file`,`component` where `component`=`component_` and `component_`=? and `directory_`=?") "SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, Indicator: "select `msiassembly`.`attributes`, `msiassembly`.`file_application`, `msiassembly`.`file_manifest`, `component`.`keypath` from `msiassembly`, `component` where `msiassembly`.`component_` = `component`.`component` and `msiassembly`.`component_` = ?") "SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = 'bz.EarlyInstallMain'" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, Indicator: "select `action`,`type`,`source`,`target`, null, `extendedtype` from `customaction` where `action` = 'bz.earlyinstallmain'") "SELECT `_Columns`.`Name` FROM `_Columns` WHERE `Table` = 'TypeLib' AND `_Columns`.`Name` = 'Cost'" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp, Indicator: "select `_columns`.`name` from `_columns` where `table` = 'typelib' and `_columns`.`name` = 'cost'") "SELECT `Message` FROM `Error` WHERE `Error` = 21" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, Indicator: "select `message` from `error` where `error` = 21") "SELECT `Message` FROM `Error` WHERE `Error` = 23" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp, Indicator: "select `message` from `error` where `error` = 23") "SELECT `Message` FROM `Error` WHERE `Error` = 16" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, Indicator: "select `message` from `error` where `error` = 16") "SELECT `Data` FROM `Binary` WHERE `Name` = '%s'" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, Indicator: "select `data` from `binary` where `name` = '%s'") "SELECT `Action`,NULL,`Condition` FROM `InstallUISequence` WHERE `Sequence` > 0 ORDER BY `Sequence`" (Source: 00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000000.79144.E7FE5000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.E7FE5000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.E7FE5000.00000004.mdmp, Indicator: "select `action`,null,`condition` from `installuisequence` where `sequence` > 0 order by `sequence`") "SELECT `Condition`, `Description` FROM `LaunchCondition`" (Source: 00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp, Indicator: "select `condition`, `description` from `launchcondition`")3b:Tbce,Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")3c:T913,Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp")3d:Tad0,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "LockResource" (Indicator: "LockResource"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp")3e:T69b,file/memory contains long string with (Indicator: "LogonUser"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") file/memory contains long string with (Indicator: "LogonUser"; File: "MSI19F6.tmp") Found reference to API "regLogonUser" (Indicator: "LogonUser"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "LogonUser" (Indicator: "LogonUser"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "[LogonUser]" (Indicator: "LogonUser"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "regLogonUser" (Indicator: "LogonUser"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "LogonUser" (Indicator: "LogonUser"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "[LogonUser]" (Indicator: "LogonUser"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp")3f:T8d6,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp")40:T93d,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")41:Ta9c,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcess"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcess"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")42:T7dc,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")43:T94a,Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartService"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "StartServiceW" (Indicator: "StartService"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartService"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")44:T4620,"WIX_UPGRADE_DETECTEDSecureCustomPropertiesWIX_DOWNGRADE_DETECTED;WIX_UPGRADE_DETECTEDSOFTWARE\[BZ.COMPANYNAME]\MSI Wrapper\Installed\[BZ.WRAPPED_APPID]LogonUser[LogonUser]regUserNameUSERNAME[USERNAME]regDateDate[Date]regTimeTime[Time]regArgumentsWRAPPED_ARGUMENTS[WRAPPED_ARGUMENTS]TuneFab, Inc.{F3D653B8-66E7-4DA7-9DA2-DF46AAD2DFEF}" in Source: 015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin "SOFTWARE\EXEMSI.COM\MSI Wrapper" in Source: 015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin "@IXOS{6345664C-0703-4D86-9FDC-73994D6E5F4D}TuneFab Apple Music ConverterD015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msiProductIcon{33FE604E-A7EE-48FA-A870-AD20ADC26059}TuneFab Apple Music ConverterRollbackRolling back action:RollbackCleanupRemoving backup filesFile: [1]ProcessComponentsUpdating component registration{EDE10F6C-30F4-42CA-B5C7-ADB905E45BFC}=02:\SOFTWARE\EXEMSI.COM\MSI Wrapper\Installed\Jfukl\LogonUser" in Source: MSI19F6.tmp "\Registry\Machine\System\CurrentControlSet\Control\FileSystem\" in Source: 00000000-00005476.00000000.92589.02F30000.00000004.mdmp "\Registry\Machine\Software\WOW6432Node\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005476.00000000.92589.02F30000.00000004.mdmp "y\Machine\System\CurrentControlSet\Control\FileSystem\" in Source: 00000000-00005476.00000000.92589.02F30000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00005476.00000000.92589.7F180000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00005720.00000000.79228.DDEA0000.00000002.mdmp 00000000-00005720.00000001.81150.DDEA0000.00000002.mdmp 00000000-00005720.00000002.83068.DDEA0000.00000002.mdmp "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\CA" in Source: 00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp "REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp "SOFTWARE\[BZ.COMPANYNAME]\MSI Wrapper\Installed\[BZ.WRAPPED_APPID]" in Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp 00000000-00005720.00000001.81150.F6560000.00000004.mdmp 00000000-00005720.00000002.83068.F6560000.00000004.mdmp "REGISTRY\USER\S-1-5-18\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp 00000000-00005720.00000001.81150.F6560000.00000004.mdmp 00000000-00005720.00000002.83068.F6560000.00000004.mdmp "Software\Microsoft\MS Setup (ACME)\User Info" in Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp 00000000-00005720.00000001.81150.F6560000.00000004.mdmp 00000000-00005720.00000002.83068.F6560000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp "SOFTWARE\EXEMSI.COM\MSI Wrapper" in Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp 00000000-00005720.00000001.81150.F6560000.00000004.mdmp 00000000-00005720.00000002.83068.F6560000.00000004.mdmp "\Registry\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005880.00000000.87037.03400000.00000004.mdmp "y\Machine\SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00005880.00000000.87037.03400000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00005880.00000000.87037.7E610000.00000002.mdmp 00000000-00005880.00000001.87884.7E610000.00000002.mdmp 00000000-00005880.00000002.89813.7E610000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Micro" in Source: 00000000-00005880.00000001.87884.00F18000.00000004.mdmp 00000000-00005880.00000002.89813.00F18000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Micro\??\C:\WINDOWS\a" in Source: 00000000-00005880.00000001.87884.00F18000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\ExtendedLocale" in Source: 00000000-00005880.00000001.87884.03400000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Rpc" in Source: 00000000-00005880.00000001.87884.03405000.00000004.mdmp 00000000-00005880.00000002.89813.03400000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microttft" in Source: 00000000-00005880.00000001.87884.03548000.00000004.mdmp 00000000-00005880.00000002.89813.03548000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00005880.00000001.87884.03580000.00000004.mdmp 00000000-00005880.00000002.89813.03580000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00005880.00000001.87884.03580000.00000004.mdmp 00000000-00005880.00000002.89813.03580000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp "HKLM\" in Source: 00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00006972.00000000.79144.5BE60000.00000004.mdmp 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp "SOFTWARE\[BZ.COMPANYNAME]\MSI Wrapper\Installed\[BZ.WRAPPED_APPID]" in Source: 00000000-00006972.00000000.79144.5BE60000.00000004.mdmp 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp "Software\Microsoft\MS Setup (ACME)\User Info" in Source: 00000000-00006972.00000000.79144.5BE60000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00006972.00000000.79144.5BE60000.00000004.mdmp "y\Machine\Software\Classes\AppID\msiexec.exe" in Source: 00000000-00006972.00000000.79144.5BE60000.00000004.mdmp 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432N" in Source: 00000000-00006972.00000000.79144.5BE60000.00000004.mdmp 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006972.00000000.79144.DDBF0000.00000002.mdmp 00000000-00006972.00000001.81067.DDBF0000.00000002.mdmp 00000000-00006972.00000002.82984.DDBF0000.00000002.mdmp "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\CA" in Source: 00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp45:T3247,"msiexec.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base cee90000 "msiexec.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base cee90000 "msiexec.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base cee90000 "msiexec.exe" loaded module "KERNEL32" at base d1220000 "msiexec.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base c73d0000 "msiexec.exe" loaded module "COMCTL32" at base bfc80000 "msiexec.exe" loaded module "KERNEL32.DLL" at base d1220000 "msiexec.exe" loaded module "COMCTL32.DLL" at base bfc80000 "msiexec.exe" loaded module "SRPAPI.DLL" at base b5dd0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\TSAPPCMP.DLL" at base 0 "msiexec.exe" loaded module "NTDLL.DLL" at base d28e0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base d0fd0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base d1030000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base d1220000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base cd270000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base d0460000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base d1470000 "msiexec.exe" loaded module "SHELL32.DLL" at base d1470000 "msiexec.exe" loaded module "OLEAUT32.DLL" at base d0390000 "msiexec.exe" loaded module "RPCRT4.DLL" at base d0e60000 "msiexec.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base d0b40000 "msiexec.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base cfe70000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base c77c0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base cdc60000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base d0cd0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base bec70000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base cd030000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base c9d80000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base c6fd0000 "msiexec.exe" loaded module "ADVAPI32.DLL" at base d0cd0000 "msiexec.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base b2ca0000 "msiexec.exe" loaded module "SHLWAPI.DLL" at base d0fd0000 "msiexec.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base cec30000 "msiexec.exe" loaded module "VERSION.DLL" at base c9d80000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base d28e0000 "msiexec.exe" loaded module "SSPICLI.DLL" at base ceb60000 "msiexec.exe" loaded module "MSIHND.DLL" at base beb20000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\PCACLI.DLL" at base c61e0000 "msiexec.exe" loaded module "MSI.DLL" at base bec70000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RPCRT4.DLL" at base d0e60000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base ceb30000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SRCLIENT.DLL" at base bcf50000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SPP.DLL" at base b2950000 "msiexec.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\FUSION.DLL" at base c7710000 "msiexec.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base af630000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base c7390000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base cee10000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 747c0000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 747c0000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 747c0000 "MsiExec.exe" loaded module "KERNEL32" at base 749a0000 "MsiExec.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72320000 "MsiExec.exe" loaded module "COMCTL32" at base 734b0000 "MsiExec.exe" loaded module "KERNEL32.DLL" at base 749a0000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\OLE32.DLL" at base 756c0000 "MsiExec.exe" loaded module "RPCRT4.DLL" at base 778d0000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\MSI.DLL" at base 71f30000 "MsiExec.exe" loaded module "MSI.DLL" at base 71f30000 "MsiExec.exe" loaded module "COMCTL32.DLL" at base 734b0000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\RPCRT4.DLL" at base 778d0000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\ADVAPI32.DLL" at base 776f0000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\KERNEL32.DLL" at base 749a0000 "MsiExec.exe" loaded module "SSPICLI.DLL" at base 744b0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71ec0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 777e0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d20000 "MsiExec.exe" loaded module "NTDLL.DLL" at base 77a90000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 737f0000 "MsiExec.exe" loaded module "SHELL32.DLL" at base 75eb0000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72920000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75eb0000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 749a0000 "MsiExec.exe" loaded module "USER32.DLL" at base 74bd0000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 72790000 "MsiExec.exe" loaded module "MSISO.DLL" at base 72730000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 747c0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75890000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 723c0000 "MsiExec.exe" loaded module "OLEAUT32.DLL" at base 74640000 "MsiExec.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74bd0000 "MsiExec.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74bd0000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 75180000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74a70000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74400000 "ICACLS.EXE" loaded module "KERNEL32" at base 749a0000 "ICACLS.EXE" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 747c0000 "ICACLS.EXE" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 747c0000 "ICACLS.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 747c0000 "ICACLS.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 747c0000 "ICACLS.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 747c0000 "ICACLS.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 747c0000 "ICACLS.EXE" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72320000 "ICACLS.EXE" loaded module "RPCRT4.DLL" at base 778d0000 "EXPAND.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 747c0000 "EXPAND.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 747c0000 "EXPAND.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 747c0000 "EXPAND.EXE" loaded module "KERNEL32" at base 749a0000 "EXPAND.EXE" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72320000 "EXPAND.EXE" loaded module "NTDLL.DLL" at base 77a90000 "EXPAND.EXE" loaded module "DPX.DLL" at base 71e30000 "EXPAND.EXE" loaded module "WDSCORE.DLL" at base 71df0000 "EXPAND.EXE" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 749a0000 "EXPAND.EXE" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 747c0000 "EXPAND.EXE" loaded module "%WINDIR%\SYSTEM32\DBGHELP.DLL" at base 71c60000 "EXPAND.EXE" loaded module "API-MS-WIN-CORE-VERSION-L1-1-1" at base 747c0000 "EXPAND.EXE" loaded module "API-MS-WIN-CORE-PSAPI-L1-1-0.DLL" at base 747c0000 "EXPAND.EXE" loaded module "CABINET.DLL" at base 72c50000 "EXPAND.EXE" loaded module "KERNEL32.DLL" at base 749a0000 "Bpznb.exe" loaded module "KERNEL32" at base 749a0000 "Bpznb.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 747c0000 "Bpznb.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 747c0000 "Bpznb.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 747c0000 "Bpznb.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77210000 "Bpznb.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 747c0000 "Bpznb.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 747c0000 "Bpznb.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 747c0000 "Bpznb.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72320000 "Bpznb.exe" loaded module "ADVAPI32.DLL" at base 776f0000 "Bpznb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 71db0000 "Bpznb.exe" loaded module "SHLWAPI.DLL" at base 75e60000 "Bpznb.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75810000 "Bpznb.exe" loaded module "VERSION.DLL" at base 73f50000 "Bpznb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 71600000 "Bpznb.exe" loaded module "USER32.DLL" at base 74bd0000 "Bpznb.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 747c0000 "Bpznb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "Bpznb.exe" loaded module "MSCOREE.DLL" at base 71e40000 "Bpznb.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75180000 "Bpznb.exe" loaded module "RPCRT4.DLL" at base 778d0000 "Bpznb.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70120000 "Bpznb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "Bpznb.exe" loaded module "OLE32.DLL" at base 756c0000 "Bpznb.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d20000 "Bpznb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "Bpznb.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75180000 "Bpznb.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 747c0000 "Bpznb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 70090000 "Bpznb.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f630000 "Bpznb.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6ee10000 "Bpznb.exe" loaded module "SHELL32.DLL" at base 75eb0000 "Bpznb.exe" loaded module "KERNEL32.DLL" at base 749a0000 "Bpznb.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "Bpznb.exe" loaded module "BCRYPT.DLL" at base 72b70000 "Bpznb.exe" loaded module "ADVAPI32" at base 776f0000 "Bpznb.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 71ec0000 "Bpznb.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 777e0000 "Bpznb.exe" loaded module "WLDP.DLL" at base 6edf0000 "Bpznb.exe" loaded module "AMSI.DLL" at base 6ede0000 "Bpznb.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73f50000 "Bpznb.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6ed90000 "Bpznb.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6ecf0000 "Bpznb.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 749a0000 "Bpznb.exe" loaded module "USERENV.DLL" at base 6edb0000 "Bpznb.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 776f0000 "Bpznb.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6e500000 "Bpznb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "Bpznb.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 6e220000 "Bpznb.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6dec0000 "Bpznb.exe" loaded module "SSPICLI.DLL" at base 744b0000 "Bpznb.exe" loaded module "NTDLL" at base 77a90000 "Bpznb.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "Bpznb.exe" loaded module "PSAPI.DLL" at base 77770000 "Bpznb.exe" loaded module "NTDLL.DLL" at base 77a90000 "Bpznb.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74400000 "Bpznb.exe" loaded module "GDI32.DLL" at base 75860000 "ICACLS.EXE" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7721000046:T1433,"SELECT `Data` FROM `Binary` WHERE `Name` = '%s'" (Source: 015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin, Indicator: "select `data` from `binary` where `name` = '%s'") "SELECT `Data` FROM `Binary` WHERE `Name`='bz.CustomActionDll'" (Source: 00000000-00005720.00000000.79228.11164000.00000004.mdmp, 00000000-00005720.00000001.81150.11164000.00000004.mdmp, 00000000-00005720.00000002.83068.11164000.00000004.mdmp, Indicator: "select `data` from `binary` where `name`='bz.customactiondll'") "SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` > 0 ORDER BY `Sequence`" (Source: 00000000-00005720.00000000.79228.11164000.00000004.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.11164000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.11164000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp, Indicator: "select `action`,null,`condition` from `installexecutesequence` where `sequence` > 0 order by `sequence`") "SELECT * FROM #_MsiRedirectedFile WHERE `Sequence` IS NOT NULL ORDER BY `Sequence`" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp, Indicator: "select * from #_msiredirectedfile where `sequence` is not null order by `sequence`") "SELECT `FileName`,`Version`,`State`,`File`.`Attributes`,`TempAttributes`,`File`,`FileSize`,`Language`,`Sequence`,`Directory_`,`Installed`,`Action`,`Component` FROM `File`,`Component` WHERE `Component`=`Component_` AND `Component_`=? AND `Directory_`=?" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp, Indicator: "select `filename`,`version`,`state`,`file`.`attributes`,`tempattributes`,`file`,`filesize`,`language`,`sequence`,`directory_`,`installed`,`action`,`component` from `file`,`component` where `component`=`component_` and `component_`=? and `directory_`=?") "SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, Indicator: "select `msiassembly`.`attributes`, `msiassembly`.`file_application`, `msiassembly`.`file_manifest`, `component`.`keypath` from `msiassembly`, `component` where `msiassembly`.`component_` = `component`.`component` and `msiassembly`.`component_` = ?") "SELECT `Action`,`Type`,`Source`,`Target`, NULL, `ExtendedType` FROM `CustomAction` WHERE `Action` = 'bz.EarlyInstallMain'" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, Indicator: "select `action`,`type`,`source`,`target`, null, `extendedtype` from `customaction` where `action` = 'bz.earlyinstallmain'") "SELECT `_Columns`.`Name` FROM `_Columns` WHERE `Table` = 'TypeLib' AND `_Columns`.`Name` = 'Cost'" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp, Indicator: "select `_columns`.`name` from `_columns` where `table` = 'typelib' and `_columns`.`name` = 'cost'") "SELECT `Message` FROM `Error` WHERE `Error` = 21" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, Indicator: "select `message` from `error` where `error` = 21") "SELECT `Message` FROM `Error` WHERE `Error` = 23" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp, Indicator: "select `message` from `error` where `error` = 23") "SELECT `Message` FROM `Error` WHERE `Error` = 16" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, Indicator: "select `message` from `error` where `error` = 16") "SELECT `Data` FROM `Binary` WHERE `Name` = '%s'" (Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, Indicator: "select `data` from `binary` where `name` = '%s'") "SELECT `Action`,NULL,`Condition` FROM `InstallUISequence` WHERE `Sequence` > 0 ORDER BY `Sequence`" (Source: 00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000000.79144.E7FE5000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.E7FE5000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.E7FE5000.00000004.mdmp, Indicator: "select `action`,null,`condition` from `installuisequence` where `sequence` > 0 order by `sequence`") "SELECT `Condition`, `Description` FROM `LaunchCondition`" (Source: 00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp, Indicator: "select `condition`, `description` from `launchcondition`")47:T82f,"msiexec.exe" touched "Window Property Store" (Path: "HKCU\CLSID\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\INSTANCE") "msiexec.exe" touched "Msi install server" (Path: "HKCU\CLSID\{000C101C-0000-0000-C000-000000000046}") "msiexec.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{000C103E-0000-0000-C000-000000000046}") "msiexec.exe" touched "SPP Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4B966436-6781-4906-8035-9AF94B32C3F7}\TREATAS") "MsiExec.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "MsiExec.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "MsiExec.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "MsiExec.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "MsiExec.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "MsiExec.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "MsiExec.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "MsiExec.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "MsiExec.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "MsiExec.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "MsiExec.exe" touched "Known Folder Manager" (Path: "HKCU\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "Bpznb.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")48:T47a,Process "msiexec.exe" (UID: 00000000-00005720) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles" Process "msiexec.exe" (UID: 00000000-00005720) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, OneDrive, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00005368) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="\\DESKTOP-FVVF82A", OneDrive="%USERPROFILE%\OneDrive", 0QvKlBSF="C:\Users\%OSUSER%", HOMEPATH="\Users\5PDhaa4", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00005368) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, Path, TEMP, USERPROFILE, TMP" Process "ICACLS.EXE" (UID: 00000000-00005988) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "ICACLS.EXE" (UID: 00000000-00005988) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles"49:T8f8,"msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ".") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "..") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "0409") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ADVANCEDINSTALLERS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPLOCKER") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPMGMT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPRAISER") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPV") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BOOT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BTHPROPS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CATROOT") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CATROOT2") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CODEINTEGRITY") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "COM") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CONFIG") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CONFIGURATION") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DDFS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DIAGSVCS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DISM") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DOWNLEVEL") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DRIVERS") "msiexec.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DRIVERSTORE")4a:Tf1a,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",03,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",02,"System.Numerics Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089",03,"System.Runtime.Serialization Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization.ni.dll",02,"System.Data Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089",0" [Source: Bpznb.exe.log] Observed system executable string:"%WINDIR%\system32\TSAPPCMP.DLL" [Source: 00000000-00006972-00000C24-70052583] Observed system executable string:"%WINDIR%\system32\SHLWAPI.DLL" [Source: 00000000-00006972-00000C24-70093123] Observed system executable string:"%WINDIR%\system32\OLE32.DLL" [Source: 00000000-00006972-00000C24-70109854] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00006972-00000C24-70155918] Observed system executable string:"%WINDIR%\system32\SHELL32.DLL" [Source: 00000000-00006972-00000C24-70262292] Observed system executable string:"%WINDIR%\system32\NETAPI32.DLL" [Source: 00000000-00006972-00000C24-70380622] Observed system executable string:"%WINDIR%\system32\WLDP.DLL" [Source: 00000000-00006972-00000C24-70614266] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00006972-00000C24-70630620] Observed system executable string:"%WINDIR%\system32\APPHELP.DLL" [Source: 00000000-00006972-00000C24-71231949] Observed system executable string:"%WINDIR%\system32\VERSION.DLL" [Source: 00000000-00006972-00000C24-71254597] Observed system executable string:"%WINDIR%\system32\sxs.DLL" [Source: 00000000-00006972-00000C24-71274350] Observed system executable string:"%WINDIR%\system32\MSCOREE.DLL" [Source: 00000000-00006972-00000C24-71340356] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006972-00000C24-71503484] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\fusion.dll" [Source: 00000000-00006972-00000C24-71648664] Observed system executable string:"%WINDIR%\system32\NTDLL.DLL" [Source: 00000000-00006972-00000C24-71888694] Observed system executable string:"%WINDIR%\system32\PCACLI.DLL" [Source: 00000000-00006972-00000C24-72268182] Observed system executable string:"%WINDIR%\system32\RPCRT4.DLL" [Source: 00000000-00005720-00000C24-72453595] Observed system executable string:"%WINDIR%\system32\USERENV.DLL" [Source: 00000000-00005720-00000C24-72469632] Observed system executable string:"%WINDIR%\system32\SRCLIENT.DLL" [Source: 00000000-00005720-00000C24-72807898] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00005720-00000C24-73530162] Observed system executable string:"%WINDIR%\system32\RSTRTMGR.DLL" [Source: 00000000-00005720-00000C24-73755263] Observed system executable string:"%WINDIR%\SysWOW64\OLE32.DLL" [Source: 00000000-00005368-00000C24-75568942] Observed system executable string:"%WINDIR%\SysWOW64\RPCRT4.DLL" [Source: 00000000-00005368-00000C24-76012424] Observed system executable string:"%WINDIR%\SysWOW64\ADVAPI32.DLL" [Source: 00000000-00005368-00000C24-76046363]4b:T460,Found reference to API "RegisterServiceCtrlHandler failed." (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "RegisterServiceCtrlHandler failed." (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")4c:Taa2,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")4d:T7ec,"12d895.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 10.0 MSI Installer Code page: 1252 Title: TuneFab Apple Music Converter 0.0.0.0 Subject: TuneFab Apple Music Converter Author: TuneFab Inc. Keywords: Installer Comments: This installation was built with Inno Setup. Template: Intel;1033 Revision Number: {33FE604E-A7EE-48FA-A870-AD20ADC26059} Create Time/Date: Sat Jul 23 12:01:26 2022 Last Saved Time/Date: Sat Jul 23 12:01:26 2022 Number of Pages: 200 Number of Words: 2 Name of Creating Application: MSI Wrapper (10.0.51.0) Security: 2"- Location: [%WINDIR%\Installer\12d895.msi]- [targetUID: 00000000-00005720] "Bpznb.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\Bpznb.exe.log]- [targetUID: 00000000-00005880] "files.cab" has type "Microsoft Cabinet archive data Windows 2000/XP setup 3312222 bytes 1 file at 0x2c +A "Bpznb.exe" ID 37090 number 1 28800 datablocks 0x1503 compression"- Location: [%TEMP%\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\files.cab]- [targetUID: 00000000-00005988] "setupact.log" has type "UTF-8 Unicode (with BOM) text with CRLF line terminators"- Location: [%WINDIR%\Logs\DPX\setupact.log]- [targetUID: 00000000-00006696] "MSI1A84.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI1A84.tmp]- [targetUID: 00000000-00005720] "ngen.log" has type "UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators"- Location: [%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ngen.log]- [targetUID: 00000000-00005720] "msiwrapper.ini" has type "data"- Location: [%TEMP%\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\msiwrapper.ini]- [targetUID: 00000000-00005988] "MSI19F6.tmp" has type "data"- Location: [%WINDIR%\Installer\MSI19F6.tmp]- [targetUID: 00000000-00005720] "MSIE21B.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSIE21B.tmp]- [targetUID: 00000000-00005720]4e:T68f,"msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "msiexec.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "")4f:Tb12,"msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "MSIEXEC"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C69CB70A-3133-4CCA-AB0E-046848EFFCDA"; Value: "")50:T81d,"msiexec.exe" trying to access non-existent file "C:\Windows\System32\TSAPPCMP.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ucrtbase_clr0400.dll" "msiexec.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "MsiExec.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "MsiExec.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "ICACLS.EXE" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "EXPAND.EXE" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Bpznb.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Bpznb.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\files\FLTLIB.DLL" "Bpznb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "Bpznb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "Bpznb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "Bpznb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "Bpznb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "Bpznb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "Bpznb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "Bpznb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "Bpznb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "Bpznb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL"51:T880,"msiexec.exe" trying to access non-existent file "C:\Windows\System32\MSIEXEC.EXE.LOCAL" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\af-ZA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\am-ET\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ar-SA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\as-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\az-Latn-AZ\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\be-BY\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\bg-BG\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\bn-BD\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\bn-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\bs-Latn-BA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ca-ES\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ca-ES-valencia\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\chr-CHER-US\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\cs-CZ\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\cy-GB\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\da-DK\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\de-DE\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\el-GR\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\en\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\en-GB\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\es-ES\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\es-MX\SXS.DLL.MUI"52:Tbd5,Heuristic match: "Il.Mm" Heuristic match: "uF.Om" Heuristic match: "z*k.tF" Heuristic match: "VR.mE" Pattern match: "www.exemsi.com" Pattern match: "http://go.microsoft.com/fwlink/?linkid=21011311/09/2022" Pattern match: "http://go.microsoft.com/fwlink/?linkid=210113" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "EXEMSI.COM" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: "fice.Int" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitReport" Pattern match: "go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=260882" Heuristic match: "Resources.SqlServer.tt" Pattern match: "http://schemas.microsoft.com/ado/2006/04/edm/ssdl" Pattern match: "http://schemas.microsoft.com/ado/2006/04/edm/providermanifest" Pattern match: "james.newtonking.com/projects/json" Heuristic match: "Json.NET is a popular high-performance JSON framework for .NET" Heuristic match: "Json.NET" Heuristic match: ">Json.NET is a popular high-performance JSON framework for .NET" Pattern match: "https://www.newtonsoft.com/jsonschema" Pattern match: "https://www.nuget.org/packages/Newtonsoft.Json.Bson" Pattern match: "Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E" Pattern match: "crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0" Pattern match: "http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F" Pattern match: "http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=" Pattern match: "http://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0O" Pattern match: "cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0" Pattern match: "https://www.newtonsoft.com/json" Pattern match: "crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0" Pattern match: "http://ocsp.digicert.com0X" Pattern match: "cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertTrustedRootG4.crt0C" Pattern match: "crl3.digicert.com/DigiCertTrustedRootG4.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Heuristic match: "C:\Program Files (x86)\[BZ.COM" Heuristic match: "PATHEXT=.COM;.EXE;.BAT;.CM"53:T1c81,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005720.00000001.81150.F6560000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdata;.0.0.0.0.0.0:\programdata\microsoft\windows" - Source: "00000000-00005880.00000001.87884.053B0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005880.00000001.87884.6ED91000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005880.00000002.89813.03580000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportmdata;.0.0.0.0.0.0:\programdata\microsoft\windows" - Source: "00000000-00005880.00000002.89813.053B0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=260882" - Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found URL "https://www.newtonsoft.com/jsonschema" - Source: "00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found URL "https://www.nuget.org/packages/newtonsoft.json.bson" - Source: "00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertcsrsa4096rootg5.crt0e>0<0:4http://crl3.digicert.com/digicertcsrsa4096rootg5.crl0a-_97h" - Source: "00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found URL "https://www.newtonsoft.com/json" - Source: "00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0xw70iq,xcu" - Source: "00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005880.00000002.89813.6ED91000.00000020.mdmp")54:T97c,Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found string "+ncalrpc:[OLE0C21525CB2BC8AB8BC09E2DA6E87]" (Indicator: "ncalrpc"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found string "+ncalrpc:[OLE2E525166BAE512BF4425213A4822]" (Indicator: "ncalrpc"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found string "+ncalrpc:[OLE7EA7A2332685E31640CD1486F6E7]" (Indicator: "ncalrpc"; Source: "00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found string "+ncalrpc:[OLE0C21525CB2BC8AB8BC09E2DA6E87]" (Indicator: "ncalrpc"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found string "+ncalrpc:[OLE2E525166BAE512BF4425213A4822]" (Indicator: "ncalrpc"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found string "B+ncalrpc:[OLE0C21525CB2BC8AB8BC09E2DA6E87]" (Indicator: "ncalrpc"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp")55:T9a2,"msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006972) "msiexec.exe" called "FindFirstFileW" with parameter C:\015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi (UID: 00000000-00006972) "msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00005720) "msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Installer\$PatchCache$\Managed\*.* (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter 000041091A0090400100000000F01FEC (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter 00004109340000000100000000F01FEC (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter 00004109510090400100000000F01FEC (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter 00004109610090400100000000F01FEC (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter 00004109810090400100000000F01FEC (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter 00004109C20090400100000000F01FEC (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter 00004109F10090400100000000F01FEC (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter 00004109F100A0C00100000000F01FEC (UID: 00000000-00005720) "msiexec.exe" called "FindNextFileW" with parameter 00004119110000000100000000F01FEC (UID: 00000000-00005720) "MsiExec.exe" called "FindFirstFileW" with parameter %TEMP%\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\* (UID: 00000000-00005368) "MsiExec.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005368) "MsiExec.exe" called "FindNextFileW" with parameter files.cab (UID: 00000000-00005368)56:T10ab,Found string "t Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005880.00000001.87884.03400000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp") Found string "SA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp, 00000000-00005880.00000002.89813.03580000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00005880.00000001.87884.07BF0000.00000004.mdmp, 00000000-00005880.00000002.89813.07BF0000.00000004.mdmp") file/memory contains long string with (Indicator: "rsa2"; Source: "00000000-00005880.00000001.87884.07BF0000.00000004.mdmp, 00000000-00005880.00000002.89813.07BF0000.00000004.mdmp") Found string "RSA2" (Indicator: "rsa2"; Source: "00000000-00005880.00000001.87884.07BF0000.00000004.mdmp, 00000000-00005880.00000002.89813.07BF0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00005880.00000002.89813.03580000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00005880.00000002.89813.063C0000.00000004.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp, 00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp, 00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp, 00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp, 00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found string "GZipStream" (Indicator: "GzipStream"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "QaESkpHX69" (Indicator: "aes"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "qaesYQGEquTjECm5gkE" (Indicator: "aes"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "J7bVVAESar" (Indicator: "aes"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "LA8LSVgrsZpJGD0yMAes" (Indicator: "aes"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "GKaTCOeAes" (Indicator: "aes"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found string "Base64LineSize" (Indicator: "base64"; Source: "00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found string "get_Base64Encoder" (Indicator: "base64"; Source: "00000000-00005880.00000002.89813.08050000.00000004.mdmp") Found string "_base64Encoder" (Indicator: "base64"; Source: "00000000-00005880.00000002.89813.08050000.00000004.mdmp")57:Ta65,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp, 00000000-00005880.00000002.89813.03580000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp, 00000000-00005880.00000002.89813.03580000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp, 00000000-00005880.00000002.89813.03580000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp, 00000000-00005880.00000002.89813.03580000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp, 00000000-00005880.00000002.89813.03580000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp, 00000000-00005880.00000002.89813.03580000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp, 00000000-00005880.00000002.89813.03580000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp, 00000000-00005880.00000002.89813.03580000.00000004.mdmp") Found reference to API "73225583438,2412,3152,,CreateCompatibleBitmap,Gdi32.dll,"00:21:02.421",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006972.00000001.81067.5BE60000.00000004.mdmp") Found reference to API "83351887477,2412,3152,,CreateCompatibleBitmap,Gdi32.dll,"00:21:06.640",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006972.00000001.81067.5BE60000.00000004.mdmp") Found reference to API "155288023036,2412,3152,,CreateCompatibleBitmap,Gdi32.dll,"00:21:36.625",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "145300912648,2412,3152,,CreateCompatibleBitmap,Gdi32.dll,"00:21:32.453",RX=0,PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006972.00000002.82984.5BE60000.00000004.mdmp")58:T1479,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.07EF0000.00000004.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")59:T11a4,Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "RegNotifyChangeKeyValue" (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")5a:T86e,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")5b:T436,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.07EF0000.00000004.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")5c:T1a44,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000001.87884.6ED91000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ED91000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000001.87884.6ED91000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ED91000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000001.87884.6ED91000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ED91000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000001.87884.6ED91000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ED91000.00000020.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005880.00000001.87884.6ED91000.00000020.mdmp, 00000000-00005880.00000002.89813.6ED91000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005880.00000001.87884.6ED91000.00000020.mdmp, 00000000-00005880.00000002.89813.6ED91000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005880.00000002.89813.07EF0000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")5d:T6b3,Found reference to API "" (Indicator: "RtlGetVersion"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "PRINT,NS_VistaRTMVersionLie::APIHook_RtlGetVersion,174,[ApiName] Hook Entered" (Indicator: "RtlGetVersion"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "10917144364,6944,3025,,RtlGetNtProductType,NTDLL.dll,"00:20:37.593",RX=0,PX=0" (Indicator: "RtlGetNtProductType"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "RtlGetVersion"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "" (Indicator: "RtlGetVersion"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "PRINT,NS_VistaRTMVersionLie::APIHook_RtlGetVersion,174,[ApiName] Hook Entered" (Indicator: "RtlGetVersion"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp")5e:T471,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")5f:T4ae,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")60:Tec7,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcessToken"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcessToken"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")61:T80a,Found string "\Device\HarddiskVolume2\Windows\System32\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead" (Indicator: "\Device\"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead" (Indicator: "\DosDevices\"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005880.00000001.87884.03580000.00000004.mdmp, 00000000-00005880.00000002.89813.03580000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp")62:T836,Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp")63:T127d,Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "RPRegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "RPRegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp")64:T581,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00005880.00000002.89813.03580000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")65:T578,Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp")66:T19b9,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp")67:T7e2,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")68:T455,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00005720.00000000.79228.F6560000.00000004.mdmp") Found reference to API "SeIncreaseQuotaPrivilegeu" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp, 00000000-00006972.00000001.81067.5BE60000.00000004.mdmp, 00000000-00006972.00000002.82984.5BE60000.00000004.mdmp") Found reference to API "SeCreateGlobalPrivilege" (Indicator: "SeCreateGlobalPrivilege"; Source: "00000000-00006972.00000000.79144.5BE60000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp")69:T6ec,"msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MSISERVER"; Key: "ALIAS"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\MSIEXEC.EXE"; Value: "") "MsiExec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\ICACLS.EXE"; Value: "") "MsiExec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\EXPAND.EXE"; Value: "") "MsiExec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\MW-BDEE92DA-8CCD-4981-9CE7-CC718CB0E0A8\FILES\BPZNB.EXE"; Value: "") "ICACLS.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "EXPAND.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "Bpznb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\MW-BDEE92DA-8CCD-4981-9CE7-CC718CB0E0A8\FILES\BPZNB.EXE"; Value: "")6a:Td2a,"ICACLS.EXE" wrote bytes "1032ab7780ecaf77208aac7700000000" to virtual address "0x77203000" (part of module "WIN32U.DLL") "ICACLS.EXE" wrote bytes "a092f402b092f402b017010080f00600c0020100b0f0060060b20600e091f402f091f402" to virtual address "0x74C4AC94" (part of module "USER32.DLL") "ICACLS.EXE" wrote bytes "309f3d77f0664077702a3c7720a43d7770233c77003b3d7710603d77b05b3d7700b03d77805b3d77d0813d77d00d3b77" to virtual address "0x7587E018" (part of module "GDI32.DLL") "EXPAND.EXE" wrote bytes "70f6e37100000000" to virtual address "0x0035E000" (part of module "EXPAND.EXE") "EXPAND.EXE" wrote bytes "30ae7f77" to virtual address "0x77981094" (part of module "RPCRT4.DLL") "EXPAND.EXE" wrote bytes "70dabd74b0a8be74" to virtual address "0x7496E2D8" (part of module "KERNELBASE.DLL") "Bpznb.exe" wrote bytes "1032ab7780ecaf77208aac7700000000" to virtual address "0x77203000" (part of module "WIN32U.DLL") "Bpznb.exe" wrote bytes "e02a4a74f0294a74702a4a74" to virtual address "0x71EE700C" (part of module "RSAENH.DLL") "Bpznb.exe" wrote bytes "70ebbe7400ecbe7440ecbe74" to virtual address "0x753901FC" (part of module "COMBASE.DLL") "Bpznb.exe" wrote bytes "b07fa377d07fa377b059a777" to virtual address "0x75DF1778" (part of module "WINDOWS.STORAGE.DLL") "Bpznb.exe" wrote bytes "30ae7f77" to virtual address "0x77981094" (part of module "RPCRT4.DLL") "Bpznb.exe" wrote bytes "c0027d75f05d7e7560067d75005f7e75" to virtual address "0x777611D8" (part of module "ADVAPI32.DLL") "Bpznb.exe" wrote bytes "d04f3475f0c21e7590c6277500cb1e75f0f3267540dd267560ef2675102d1f7580a61e7520be257570422775a0be2575c0ff1e7540bf2575e0582775" to virtual address "0x75DF15B0" (part of module "WINDOWS.STORAGE.DLL") "Bpznb.exe" wrote bytes "a092f402b092f402b017010080f00600c0020100b0f0060060b20600e091f402f091f402" to virtual address "0x74C4AC94" (part of module "USER32.DLL") "Bpznb.exe" wrote bytes "10f2be7400b9bd74f091b177109dbe749092be74c0b4be745088be74d067be7440b2be74209cbe74108cbe74a0a4be74507cbe7450a9be74c0b3be74805dbe74c0e6be749075be74c0eebe74a0c4be7400c0be7410d2bd7460aabe74" to virtual address "0x75390228" (part of module "COMBASE.DLL") "Bpznb.exe" wrote bytes "10d4c86e00b8c86e30d3c86e70d4c86e50d4c86e60adc86ed0d2c86e50b5c86e90adc86e10b4c86ec0b3c86ec0d4c86e307dc86e20c2c86e007cc86e7087c86e807ec86e20c3c86e10aec86e70d2c86eb086c86ec0d5c86ea0d5c86e" to virtual address "0x7496E0E4" (part of module "KERNELBASE.DLL") "Bpznb.exe" wrote bytes "c0027d7560067d75" to virtual address "0x7539004C" (part of module "COMBASE.DLL") "Bpznb.exe" wrote bytes "c0da4b74c0db4b74d07a4c74" to virtual address "0x777610C0" (part of module "ADVAPI32.DLL") "Bpznb.exe" wrote bytes "0a289cf1" to virtual address "0x7160F798" (part of module "CLR.DLL") "Bpznb.exe" wrote bytes "edcad66e1069db6e0000000062cbd66e0000000012cbd66e1ccbd66e30cbd66e3acbd66e44cbd66e4ecbd66e58cbd66ef7cad66e26cbd66e00000000" to virtual address "0x6ED83000" (part of module "MPCLIENT.DLL") "Bpznb.exe" wrote bytes "1036817520368175" to virtual address "0x753901A0" (part of module "COMBASE.DLL") "Bpznb.exe" wrote bytes "40d27c75300d7d75e0f67c75c0cd7c75" to virtual address "0x75DF16C4" (part of module "WINDOWS.STORAGE.DLL") "Bpznb.exe" wrote bytes "309f3d77f0664077702a3c7720a43d7770233c77003b3d7710603d77b05b3d7700b03d77805b3d77d0813d77d00d3b77" to virtual address "0x7587E018" (part of module "GDI32.DLL")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790607290912,"unified_at":"2026-09-28T14:54:50.912Z","metadata":{"hashes":{"sha256":"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925","sha1":"7af29257d77bab7ed5a70293abe44da3c1c10c37","md5":"c39fec313f716b37b80ccf946ef5cc83","sha512":"0eeb8fa73bbf1886101db96ea376343fae6bae872a264b55feb58a1060c75772f45b5244b005613830e056cd7a58f8307bb54c01417cacd7a57d46542b160291","ssdeep":"49152:LpUPlOPlQRNDP9nqI5KKs2p8iYu9ap7QqKHKG+n2H6h1Ug:LpTt4NDVPKB2vinG8n2Hs","ssdeep_chunks":["49152:LpUPlOP","49152:pUPlOPl","49152:UPlOPlQ","49152:PlOPlQR","49152:lOPlQRN","49152:OPlQRND","49152:PlQRNDP","49152:lQRNDP9","49152:QRNDP9n","49152:RNDP9nq","49152:NDP9nqI","49152:DP9nqI5","49152:P9nqI5K","49152:9nqI5KK","49152:nqI5KKs","49152:qI5KKs2","49152:I5KKs2p","49152:5KKs2p8","49152:KKs2p8i","49152:Ks2p8iY","49152:s2p8iYu","49152:2p8iYu9","49152:p8iYu9a","49152:8iYu9ap","49152:iYu9ap7","49152:Yu9ap7Q","49152:u9ap7Qq","49152:9ap7QqK","49152:ap7QqKH","49152:p7QqKHK","49152:7QqKHKG","49152:QqKHKG+","49152:qKHKG+n","49152:KHKG+n2","49152:HKG+n2H","49152:KG+n2H6","49152:G+n2H6h","49152:+n2H6h1","49152:n2H6h1U","49152:2H6h1Ug","98304:LpUPlOP","98304:pUPlOPl","98304:UPlOPlQ","98304:PlOPlQR","98304:lOPlQRN","98304:OPlQRND","98304:PlQRNDP","98304:lQRNDP9","98304:QRNDP9n","98304:RNDP9nq","98304:NDP9nqI","98304:DP9nqI5","98304:P9nqI5K","98304:9nqI5KK","98304:nqI5KKs","98304:qI5KKs2","98304:I5KKs2p","98304:5KKs2p8","98304:KKs2p8i","98304:Ks2p8iY","98304:s2p8iYu","98304:2p8iYu9","98304:p8iYu9a","98304:8iYu9ap","98304:iYu9ap7","98304:Yu9ap7Q","98304:u9ap7Qq","98304:9ap7QqK","98304:ap7QqKH","98304:p7QqKHK","98304:7QqKHKG","98304:QqKHKG+","98304:qKHKG+n","98304:KHKG+n2","98304:HKG+n2H","98304:KG+n2H6","98304:G+n2H6h","98304:+n2H6h1","98304:n2H6h1U","98304:2H6h1Ug","49152:LpTt4ND","49152:pTt4NDV","49152:Tt4NDVP","49152:t4NDVPK","49152:4NDVPKB","49152:NDVPKB2","49152:DVPKB2v","49152:VPKB2vi","49152:PKB2vin","49152:KB2vinG","49152:B2vinG8","49152:2vinG8n","49152:vinG8n2","49152:inG8n2H","49152:nG8n2Hs"],"imphash":"Unknown"},"file_info":{"file_name":"bounty-43461097661075379","file_type":["msi","data"],"file_type_id":"msi","file_size":3936256,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1678982496000,"last_seen":1679259606000,"last_multi_scan":1679259606000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["agent","agenttesla","badjoke","bingoml","bladabindi","brosafe","burkina","cobaltstrike","e5","fynloski","generik","kryptik","njrat","phish","rat","stealer","trojan"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":68},"sandbox_signatures":{"informative_count":169,"suspicious_count":16,"malicious_count":8,"total":193},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"},{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Detected expand command line utility (used to expand or compress files)"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Windows File and Directory Permissions Modification","attack_id":"T1222.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1222/001","identifiers":[{"type":"malicious","value":"Modifies the access control lists of files"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Creates a setup/installation log file"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Contains ability to copy files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"Bpznb.exe\" called \"FindResourceW\" (UID: 00000000-00005880)\n \"Bpznb.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00005880)\n \"Bpznb.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00005880)\n \"Bpznb.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00005880)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"msiexec.exe\" called \"LoadResource with parameter \" (UID: 00000000-00006972)\n \"msiexec.exe\" called \"LoadResource with parameter {'hModule': '1568997378', 'hResInfo': '1569064464'}\" (UID: 00000000-00006972)\n \"msiexec.exe\" called \"LoadResource with parameter {'hModule': '4140171266', 'hResInfo': '4140238352'}\" (UID: 00000000-00005720)\n \"msiexec.exe\" called \"LoadResource with parameter \" (UID: 00000000-00005720)\n \"msiexec.exe\" called \"LoadResource with parameter {'hModule': '3346071552', 'hResInfo': '3346174024'}\" (UID: 00000000-00005720)\n \"msiexec.exe\" called \"LoadResource with parameter {'hModule': '4150329345', 'hResInfo': '4140696792'}\" (UID: 00000000-00005720)\n \"Bpznb.exe\" called \"LoadResource with parameter \" (UID: 00000000-00005880)\n \"Bpznb.exe\" called \"LoadResource with parameter {'hModule': '61341697', 'hResInfo': '61342976'}\" (UID: 00000000-00005880)\n \"Bpznb.exe\" called \"LoadResource with parameter {'hModule': '61341697', 'hResInfo': '61342992'}\" (UID: 00000000-00005880)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"msiexec.exe\" called \"RemoveDirectoryW\" with parameter C:\\MSI2d682.tmp (UID: 00000000-00006972)\n \"msiexec.exe\" called \"RemoveDirectoryW\" (UID: 00000000-00006972)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005880.00000001.87884.03580000.00000004.mdmp, 00000000-00005880.00000002.89813.03580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeW\" (Indicator: \"RpcStringFree\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$2d","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"EXPAND.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\9f80db5bcd6244b7a4d53e28e7d24c79$dpx$.tmp\\3495c6752f74c748b66603c26f1247c7.tmp\" to \"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n FFFFFFFFh in Stream UID: 45126-20-100126E0\n Assembly shows XOR instruction xor eax\n edx in Stream UID: 45126-20-100126E0\n Assembly shows XOR instruction xor edi\n edx in Stream UID: 45126-27-10010E80\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 45126-24-1000FE3B\n Assembly shows XOR instruction xor ecx\n ebp in Stream UID: 45126-24-1000FE3B\n Assembly shows XOR instruction xor dword ptr [ebp-04h]\n eax in Stream UID: 45126-38-1001236C\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 45126-38-1001236C\n Assembly shows XOR instruction xor ecx\n edx in Stream UID: 45126-56-100112F0\n Assembly shows XOR instruction xor edi\n edx in Stream UID: 45126-56-100112F0\n Assembly shows XOR instruction xor dword ptr [ebp-08h]\n eax in Stream UID: 45126-73-10018240\n Assembly shows XOR instruction xor eax\n ebp in Stream UID: 45126-73-10018240","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00005880.00000002.89813.07EF0000.00000004.mdmp, 00000000-00005880.00000002.89813.08050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"MsiExec.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005368)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"msiexec.exe\" called \"IsWow64Process\" with parameter \"5720\" - (UID: 00000000-00005720)\n \"Bpznb.exe\" called \"IsWow64Process\" with parameter \"5880\" - (UID: 00000000-00005880)\n \"Bpznb.exe\" called \"IsWow64Process\" (UID: 00000000-00005880)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"msiexec.exe\" called \"GetWindowTextW\" (UID: 00000000-00006972)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Preparing to install...\" - (UID: 00000000-00006972)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00006972)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Please wait while Windows configures TuneFab Apple Music Converter\" - (UID: 00000000-00006972)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"msiexec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006972)\n \"msiexec.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00006972)\n \"msiexec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005720)\n \"msiexec.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"msiexec.exe\" called \"OpenMutexW\" with parameter \"Global\\_MSIExecute\" - (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"Bpznb.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f02300000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00005880)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"Bpznb.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00005880)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"msiexec.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00006972)\n \"msiexec.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"msiexec.exe\" called \"GetLocaleInfoW\" (UID: 00000000-00006972)\n \"msiexec.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005720)\n \"Bpznb.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00005880)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM #_MsiRedirectedFile WHERE `Sequence` IS NOT NULL ORDER BY `Sequence`\" (Indicator: \"select * from \"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$31","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"msiexec.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"msiexec.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\0\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Bpznb.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\" at 00000000-00005880-00000C15-196411218\n \"Bpznb.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Numerics\\v4.0_4.0.0.0__b77a5c561934e089\\System.Numerics.dll\" at 00000000-00005880-00000C15-213336685\n \"Bpznb.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00005880-00000C15-213484774\n \"Bpznb.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00005880-00000C15-213517907\n \"Bpznb.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00005880-00000C15-213518113","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"ICACLS.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Bpznb.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Bpznb.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ICACLS.EXE\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EXPAND.EXE\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\BPZNB.EXE\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\JFUKL\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\JFUKL\")\n \"MsiExec.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\JFUKL\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"Bpznb.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00005880)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"msiexec.exe\" called \"CreateDirectoryW\" with parameter C:\\MSI2d682.tmp (UID: 00000000-00006972)\n \"msiexec.exe\" called \"CreateDirectoryW\" with parameter Z:\\MSI2d683.tmp (UID: 00000000-00006972)\n \"MsiExec.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\ (UID: 00000000-00005368)\n \"MsiExec.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\ (UID: 00000000-00005368)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"MsiExec.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\ICACLS.EXE\" \"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\.\" /SETINTEGRITYLEVE\" - (UID: 00000000-00005368)\n \"MsiExec.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\EXPAND.EXE\" -R files.cab -F:* files\" - (UID: 00000000-00005368)\n \"MsiExec.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\"\" - (UID: 00000000-00005368)\n \"Bpznb.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\" - (UID: 00000000-00005880)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00005880.00000002.89813.07EF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\ss2\\Projects\\MsiWrapper\\MsiCustomActions\\Release\\MsiCustomActions.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to copy files (API string)","description":"Found reference to API \"CopyFile\" (Indicator: \"CopyFile\"; Source: \"00000000-00005880.00000002.89813.07EF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-449","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")\n Found reference to API \"CreateProcessingInstruction\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005880.00000002.89813.08050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"ShellExecuteEx failed (%d).\" (Indicator: \"ShellExecute\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"ShellExecuteEx failed (%d).\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005880.00000002.89813.07EF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger\n licensed by Dinkumware\n Ltd. ALL RIGHTS RESERVED.\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-462","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$44","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Global\\SetupLog\"\n \"SM0:5880:168:WilStaging_02\"\n \"Local\\SM0:5880:168:WilStaging_02\"\n \"SM0:5880:64:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Detected expand command line utility (used to expand or compress files)","description":"Process \"EXPAND.EXE\" with commandline \"-R files.cab -F:* files\" (UID: 00000000-00006696)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":3,"id":"target-317","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"msiexec.exe\" failed to load missing module \"%WINDIR%\\system32\\TSAPPCMP.DLL\" - [base:0; Status:c0000135]\n \"Bpznb.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll\" - [base:0; Status:c0000135]\n \"Bpznb.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ole32.dll\" - [base:0; Status:c0000135]\n \"Bpznb.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:c0000135]\n \"Bpznb.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:c0000135]\n \"Bpznb.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\VERSION.dll\" - [base:0; Status:c0000135]\n \"Bpznb.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"MSI1A84.tmp\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"Bpznb.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70120000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"Bpznb.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6EDE0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at CEE10000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at CE730000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 777E0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72B70000\n \"ICACLS.EXE\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 777E0000\n \"EXPAND.EXE\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 777E0000\n \"Bpznb.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 777E0000\n \"Bpznb.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72B70000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at AF630000\n \"Bpznb.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 71600000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D0E60000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 778D0000\n \"ICACLS.EXE\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 778D0000\n \"EXPAND.EXE\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 778D0000\n \"Bpznb.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 778D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c700cffd7f0000@ntdll.dll\"\n \"220023000000000018c700cffd7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"MSI1A84.tmp\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"MSI1A84.tmp\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$46","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$47","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$48","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$49","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00005720)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding B5F8200ECFA1021BF5641E273676D91F\" (UID: 00000000-00005368)\n Spawned process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\\\.\" /SETINTEGRI ...\" (UID: 00000000-00005988)\n Spawned process \"EXPAND.EXE\" with commandline \"-R files.cab -F:* files\" (UID: 00000000-00006696)\n Spawned process \"Bpznb.exe\" (UID: 00000000-00005880)\n Spawned process \"Bpznb.exe\" (UID: 00000000-00005476)\n Spawned process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\\\.\" /SETINTEGRI ...\" (UID: 00000000-00001320)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00005720)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding B5F8200ECFA1021BF5641E273676D91F\" (UID: 00000000-00005368)\n Spawned process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\\\.\" /SETINTEGRI ...\" (UID: 00000000-00005988)\n Spawned process \"EXPAND.EXE\" with commandline \"-R files.cab -F:* files\" (UID: 00000000-00006696)\n Spawned process \"Bpznb.exe\" (UID: 00000000-00005880)\n Spawned process \"Bpznb.exe\" (UID: 00000000-00005476)\n Spawned process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\\\.\" /SETINTEGRI ...\" (UID: 00000000-00001320)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"MSI1A84.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"MsiExec.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\msiwrapper.ini\"\n \"MsiExec.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files.cab\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a setup/installation log file","description":"\"setupact.log\" has type \"UTF-8 Unicode (with BOM) text with CRLF line terminators\"- Location: [%WINDIR%\\Logs\\DPX\\setupact.log]- [targetUID: 00000000-00006696]","origin":"Binary File","mitre_attack_id":"T1083","id":"binary-51","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"EXPAND.EXE\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"Bpznb.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"MSI1A84.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" - Location: [%WINDIR%\\Installer\\MSI1A84.tmp]\n \"MSI19F6.tmp\" has type \"data\" - Location: [%WINDIR%\\Installer\\MSI19F6.tmp]\n \"MSIE21B.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" - Location: [%WINDIR%\\Installer\\MSIE21B.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Bpznb.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\" (UID: 5880)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"msiexec.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"\n \"msiexec.exe\" reads file \"c:\\windows\\installer\\12d895.msi\"\n \"msiexec.exe\" reads file \"c:\\015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"msiexec.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"msiexec.exe\" trying to touch file \"C:\\Windows\\System32\\msiexec.exe\"\n \"msiexec.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"msiexec.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"msiexec.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"msiexec.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"msiexec.exe\" trying to touch file \"C:\\Windows\\System32\\AcLayers.dll\"\n \"msiexec.exe\" trying to touch file \"C:\\Windows\\System32\\sfc.dll\"\n \"msiexec.exe\" trying to touch file \"C:\\Windows\\System32\\winspool.drv\"\n \"msiexec.exe\" trying to touch file \"C:\\Windows\\System32\\IPHLPAPI.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"msiexec.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Templates\"\n \"msiexec.exe\" touched file \"C:\\Windows\\Fonts\"\n \"msiexec.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates\"\n \"msiexec.exe\" touched file \"C:\\Windows\\Installer\\12d895.msi\"\n \"msiexec.exe\" touched file \"C:\\Windows\\Installer\\SourceHash{6345664C-0703-4D86-9FDC-73994D6E5F4D}\"\n \"msiexec.exe\" touched file \"C:\\Windows\\Temp\\~DF58CF642104835E5E.TMP\"\n \"msiexec.exe\" touched file \"C:\\Windows\\Installer\\inprogressinstallinfo.ipi\"\n \"msiexec.exe\" touched file \"C:\\Windows\\Temp\\~DF3E808257E8D3EAD7.TMP\"\n \"msiexec.exe\" touched file \"C:\\Windows\\Installer\\MSIE21B.tmp\"\n \"MsiExec.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"MsiExec.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"EXPAND.EXE\" touched file \"C:\\Windows\\Logs\\DPX\\setupact.log\"\n \"EXPAND.EXE\" touched file \"C:\\Windows\\Logs\\DPX\\setuperr.log\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"msiexec.exe\" writes file \"\\device\\namedpipe\\wkssvc\"\n \"msiexec.exe\" writes file \"c:\\windows\\installer\\12d895.msi\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"msiexec.exe\" writes a file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.log\"\n \"EXPAND.EXE\" writes a file \"C:\\Windows\\Logs\\DPX\\setupact.log\"\n \"Bpznb.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Bpznb.exe.log\"\n \"Bpznb.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Bpznb.exe.log\"\n \"EXPAND.EXE\" writes a file \"%WINDIR%\\Logs\\DPX\\setupact.log\"\n \"msiexec.exe\" writes a file \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005880.00000001.87884.6ECF1000.00000020.mdmp, 00000000-00005880.00000002.89813.6ECF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$52","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$53","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$54","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"msiexec.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"100729044\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"msiexec.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"100729044\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"msiexec.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"721488361\"\n \"cx\": \"90\"\n \"cy\": \"23\"}\n \"msiexec.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16845249\"\n \"cx\": \"32\"\n \"cy\": \"32\"}\n \"msiexec.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16845249\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"msiexec.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"553715905\"\n \"cx\": \"273\"\n \"cy\": \"16\"}\n \"msiexec.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"721488361\"\n \"cx\": \"273\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"msiexec.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006972)\n \"msiexec.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"ICACLS.EXE\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Bpznb.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Bpznb.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00005880)\n \"Bpznb.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00005476)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Bpznb.exe\" called \"GetComputerNameW\" (UID: 00000000-00005880)\n \"Bpznb.exe\" called \"GetComputerNameA\" (UID: 00000000-00005476)\n \"Bpznb.exe\" called \"GetComputerNameW\" (UID: 00000000-00005476)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"msiexec.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}\n \"msiexec.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00005720)\n \"MsiExec.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"Bpznb.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00005880)\n \"Bpznb.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Bpznb.exe\" called \"GetUserNameW\" (UID: 00000000-00005880)\n \"Bpznb.exe\" called \"GetUserNameA\" (UID: 00000000-00005476)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$56","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE [\" (Indicator: \"where \"; Source: \"00000000-00005880.00000002.89813.07EF0000.00000004.mdmp\")\n Found string \"WHERE t.TABLE_SCHEMA + '.' + t.TABLE_NAME IN (\" (Indicator: \"where \"; Source: \"00000000-00005880.00000002.89813.07EF0000.00000004.mdmp\")\n Found string \"WHERE tc.TABLE_NAME IS NOT NULL\" (Indicator: \"where \"; Source: \"00000000-00005880.00000002.89813.07EF0000.00000004.mdmp\")\n Found string \"WHERE 1=2\" (Indicator: \"where \"; Source: \"00000000-00005880.00000002.89813.07EF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"00000000-00005880.00000002.89813.07EF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-217","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00005880.00000001.87884.6ED91000.00000020.mdmp, 00000000-00005880.00000002.89813.6ED91000.00000020.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp\n \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00005720.00000000.79228.F6560000.00000004.mdmp\n 00000000-00005720.00000001.81150.F6560000.00000004.mdmp\n 00000000-00005720.00000002.83068.F6560000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"k__BackingField\" (Indicator: \"\"; Source: \"00000000-00005880.00000002.89813.08050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"msiexec.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006972)\n \"msiexec.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005720)\n \"Bpznb.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00005880)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$61","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005720.00000000.79228.DEB8A000.00000002.mdmp, 00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.DEB8A000.00000002.mdmp, 00000000-00005720.00000002.83068.DEB8A000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000001.87884.6EDA5000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6EDA5000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006972.00000000.79144.DEB8A000.00000002.mdmp, 00000000-00006972.00000001.81067.DEB8A000.00000002.mdmp, 00000000-00006972.00000002.82984.DEB8A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\VSS\\DIAG\")\n \"msiexec.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\VSS\\DIAG\\SPP\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$69","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\Device\\HarddiskVolume2\\DosDevices\\C:\\??\\Volume{815ead\" (Indicator: \"\\DosDevices\\c:\"; Source: \"00000000-00005720.00000000.79228.F6560000.00000004.mdmp, 00000000-00005720.00000001.81150.F6560000.00000004.mdmp, 00000000-00005720.00000002.83068.F6560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1014","relevance":1,"id":"string-458","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"services.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\" (Source: \"00000000-00005720.00000000.79228.F7690000.00000004.mdmp, 00000000-00005720.00000001.81150.F7690000.00000004.mdmp, 00000000-00005720.00000002.83068.F7690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00005880.00000001.87884.6ED81000.00000002.mdmp, 00000000-00005880.00000002.89813.6ED81000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Bpznb.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Bpznb.exe.log]- [targetUID: 00000000-00005880]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"ICACLS.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"EXPAND.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"EXPAND.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Bpznb.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Bpznb.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"Bpznb.exe\" is allocating memory with PAGE_GUARD access rights (Handle: 4294967295); (PID: 5880)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"msiexec.exe\" called \"FileTimeToLocalFileTime\" with parameter 0017f042519ed801 & 0017f042519ed801 (UID: 00000000-00006972)\n \"msiexec.exe\" called \"FileTimeToLocalFileTime\" with parameter 0017f042519ed801 & 0017f042519ed801 (UID: 00000000-00005720)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\C4665436307068D4F9CD3799D4E6F5D4\\INSTALLPROPERTIES\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"6/89 reputation engines marked \"http://system.web.services\" as malicious (6% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"30/57 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"MsiExec.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\msiwrapper.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"MSI1A84.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI1A84.tmp]- [targetUID: 00000000-00005720]\n \"MSIE21B.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSIE21B.tmp]- [targetUID: 00000000-00005720]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"EXPAND.EXE\" wrote 32768 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\9f80db5bcd6244b7a4d53e28e7d24c79$dpx$.tmp\\3495c6752f74c748b66603c26f1247c7.tmp\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"0.0.0.0\" found in string \"TuneFab Apple Music Converter 0.0.0.0\"\n Potential IP \"10.0.51.0\" found in string \"MSI Wrapper (10.0.51.0)\"\n \"192.168.241.64\"\n \"0.0.0.0\"\n \"10.0.51.0\"\n Potential IP \"10.0.51.0\" found in string \"MSI Wrapper (10.0.51.0\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Xml,4.0.0.0,,b77a5c561934e089\"\n Potential IP \"4.0.0.0\" found in string \"ystem.Data.SqlXml,4.0.0.0,,b77a5c561934e089,MSIL\"\n \"0.0.0.00000\"\n Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0, C\"\n Potential IP \"13.0.0.0\" found in string \"ewtonsoft.Json,13.0.0.0,,30ad4fe6b2a6aeed\"\n \"1.0.0.0\"\n \"6.0.0.0\"\n \"16.0.0.0\"\n \"13.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00005720.00000000.79228.F7690000.00000004.mdmp, 00000000-00005720.00000001.81150.F7690000.00000004.mdmp, 00000000-00005720.00000002.83068.F7690000.00000004.mdmp\")\n Found string \"WMIADAP.exe\" (Indicator: \"wmiadap.exe\"; in Source: \"00000000-00005720.00000000.79228.F7690000.00000004.mdmp, 00000000-00005720.00000001.81150.F7690000.00000004.mdmp, 00000000-00005720.00000002.83068.F7690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00005880.00000002.89813.07EF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"MsiExec.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"MSI1A84.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSI1A84.tmp]- [targetUID: 00000000-00005720]\n \"MSIE21B.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%WINDIR%\\Installer\\MSIE21B.tmp]- [targetUID: 00000000-00005720]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"Bpznb.exe.log\" contains indicator \".Run\" (Line: 7; Offset: 9)","origin":"Binary File","mitre_attack_id":"T1105","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"files.cab\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 3312222 bytes 1 file at 0x2c +A \"Bpznb.exe\" ID 37090 number 1 28800 datablocks 0x1503 compression\"- Location: [%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files.cab]- [targetUID: 00000000-00005988]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$6a","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"MsiExec.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\ICACLS.EXE\" \"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\.\" /SETINTEGRITYLEVE\" - (UID: 00000000-00005368)\n \"MsiExec.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\EXPAND.EXE\" -R files.cab -F:* files\" - (UID: 00000000-00005368)\n \"MsiExec.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\"\" - (UID: 00000000-00005368)\n \"Bpznb.exe\" called \"CreateProcessA\" with parameter \"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\" - (UID: 00000000-00005880)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"30/57 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSI1A84.tmp\"\n File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\Installer\\MSIE21B.tmp\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"Bpznb.exe\" set thread context in remote process \"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\" (PID: 1564)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"Bpznb.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\" (Handle: 1160)\n \"Bpznb.exe\" wrote 1024 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\" (Handle: 1160)\n \"Bpznb.exe\" wrote 56832 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\" (Handle: 1160)\n \"Bpznb.exe\" wrote 13312 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\" (Handle: 1160)\n \"Bpznb.exe\" wrote 10752 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe\" (Handle: 1160)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\\\.\" /SETINTEGRITYLEVEL (CI)(OI)HIGH\" (UID: 00000000-00005988)\n Process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\\\.\" /SETINTEGRITYLEVEL (CI)(OI)LOW\" (UID: 00000000-00001320)","origin":"Monitored Target","mitre_attack_id":"T1222.001","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\\\.\" /SETINTEGRITYLEVEL (CI)(OI)HIGH\" (UID: 00000000-00005988)\n Spawned process \"EXPAND.EXE\" with commandline \"-R files.cab -F:* files\" (UID: 00000000-00006696)\n Spawned process \"Bpznb.exe\" (UID: 00000000-00005880)\n Spawned process \"Bpznb.exe\" (UID: 00000000-00005476)\n Spawned process \"ICACLS.EXE\" with commandline \"\"%TEMP%\\\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\\\.\" /SETINTEGRITYLEVEL (CI)(OI)LOW\" (UID: 00000000-00001320)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]}],"incidents":[{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":112,"dropped_files_count":0,"extracted_files_count":9,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["agent","agenttesla","badjoke","bingoml","bladabindi","brosafe","burkina","cobaltstrike","e5","fynloski","generik","kryptik","njrat","phish","rat","stealer","trojan"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"648faa09512c2bab760fb499","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi","analysis_start_time":"2023-06-19T01:21:21+00:00","indicators_count":{"informative":169,"suspicious":40,"malicious":8},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}],"processes":[{"pid":6972,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925.msi\"","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00006972","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":5720,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00005720","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":5368,"ppid":5720,"name":"MsiExec.exe","command_line":"-Embedding B5F8200ECFA1021BF5641E273676D91F","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00005720","uid":"00000000-00005368"},{"pid":5988,"ppid":5368,"name":"ICACLS.EXE","command_line":"\"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\.\" /SETINTEGRITYLEVEL (CI)(OI)HIGH","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\ICACLS.EXE","parent_uid":"00000000-00005368","uid":"00000000-00005988"},{"pid":6696,"ppid":5368,"name":"EXPAND.EXE","command_line":"-R files.cab -F:* files","sha256":"e4cdd94f52c17d6877851c81e064ea4b85bd247fdb14bff13fdfe16797083c7b","normalized_path":"%WINDIR%\\SysWOW64\\EXPAND.EXE","parent_uid":"00000000-00005368","uid":"00000000-00006696"},{"pid":5880,"ppid":5368,"name":"Bpznb.exe","command_line":"","sha256":"a918b48176792f8fda48ccb3912419cdef9b41731ffff056db86c75341ac1ac0","normalized_path":"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe","parent_uid":"00000000-00005368","uid":"00000000-00005880"},{"pid":5476,"ppid":5880,"name":"Bpznb.exe","command_line":"","sha256":"a918b48176792f8fda48ccb3912419cdef9b41731ffff056db86c75341ac1ac0","normalized_path":"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\Bpznb.exe","parent_uid":"00000000-00005880","uid":"00000000-00005476"},{"pid":1320,"ppid":5368,"name":"ICACLS.EXE","command_line":"\"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\.\" /SETINTEGRITYLEVEL (CI)(OI)LOW","sha256":"b027bc868d5c167804b33d0ccefcef0753d49eb2fb57f21f43e3fbb08d327e2e","normalized_path":"%WINDIR%\\SysWOW64\\ICACLS.EXE","parent_uid":"00000000-00005368","uid":"00000000-00001320"}],"all_imported_dlls":["win32u.dll","imm32.dll","CoreUIComponents.dll","cabinet.dll","mscorlib.ni.dll","System.Core.ni.dll","amsi.dll","MpClient.dll","urlmon.dll","wdscore.dll","clrjit.dll","psapi.dll","user32.dll","gdi32full.dll","windows.storage.dll","sspicli.dll","srclient.dll","RstrtMgr.dll","wow64.dll","wow64cpu.dll","ntdll.dll","VxSSL64.dll","ws2_32.dll","fltLib.dll","wkscli.dll","clr.dll","cryptbase.dll","dpx.dll","kernel32.dll","ucrtbase.dll","sfc.dll","VxSSL32.dll","imagehlp.dll","System.ni.dll","gpapi.dll","msasn1.dll","oleaut32.dll","powrprof.dll","mpr.dll","ucrtbase_clr0400.dll","wow64win.dll","Windows.StateRepositoryPS.dll","iertutil.dll","comctl32.dll","msctf.dll","ntmarta.dll","wintrust.dll","spp.dll","ntasn1.dll","dbgcore.dll","System.Runtime.Serialization.ni.dll","coml2.dll","netutils.dll","vcruntime140_clr0400.dll","MpOAV.dll","gdi32.dll","combase.dll","ole32.dll","profapi.dll","ncrypt.dll","edputil.dll","sppc.dll","System.Numerics.dll","CoreMessaging.dll","WinTypes.dll","msihnd.dll","fusion.dll","System.Xml.ni.dll","srpapi.dll","propsys.dll","vssapi.dll","msIso.dll","IPHLPAPI.DLL","shell32.dll","netapi32.dll","vsstrace.dll","rsaenh.dll","dbghelp.dll","slc.dll","System.Data.dll","TextInputFramework.dll","wldp.dll","apphelp.dll","msvcrt.dll","rpcrt4.dll","bcrypt.dll","sfc_os.dll","msi.dll","dwmapi.dll","samcli.dll","AcLayers.dll","shlwapi.dll","advapi32.dll","SHCore.dll","crypt32.dll","version.dll","KernelBase.dll","msvcp_win.dll","bcryptprimitives.dll","uxtheme.dll","pcacli.dll","cryptsp.dll","cldapi.dll","aepic.dll","sechost.dll","cfgmgr32.dll","kernel.appcore.dll","clbcatq.dll","mscoree.dll","mscoreei.dll","userenv.dll","setupapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"MSI1A84.tmp","sha256":"107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"MSIE21B.tmp","sha256":"107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"files.cab","sha256":"a74cd4380aa8bdca4391c1a76073bf8ca20c6b605f93d359f46638e994a9d3ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"Bpznb.exe.log","sha256":"05672c65f51bf866467f211ad84aac90cdd88bb8ad7e6c2683c2e71a0bd42461","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"msiwrapper.ini","sha256":"32b178d7013ed953f9711348d06ae458424175bab1166cccc8b2744ea7ee0ceb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"12d895.msi","sha256":"015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"MSI19F6.tmp","sha256":"d9d0e1fc1eb4b48916a74cda31e0ec093326e2d5b4dbd110bf71bf9f3f862167","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"setupact.log","sha256":"5f1c6f3aff995871d5257d404cfdd63af8019bf1749745cfa871abcee7273282","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"ngen.log","sha256":"ecb05f129963390e6c7a379956c04759e29e4f13fffe670a945e57a7617c6623","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]}],"files_written":[{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%WINDIR%\\Installer\\SourceHash{6345664C-0703-4D86-9FDC-73994D6E5F4D}","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%WINDIR%\\Temp\\~DF58CF642104835E5E.TMP","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%WINDIR%\\Temp\\~DF3E808257E8D3EAD7.TMP","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%WINDIR%\\Logs\\DPX\\setupact.log","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%WINDIR%\\Logs\\DPX\\setuperr.log","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%TEMP%\\MW-bdee92da-8ccd-4981-9ce7-cc718cb0e0a8\\files\\9f80db5bcd6244b7a4d53e28e7d24c79$dpx$.tmp\\3495c6752f74c748b66603c26f1247c7.tmp","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\Bpznb.exe.log","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%WINDIR%\\Temp\\~DFAF08F19B25D5AABA.TMP","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%WINDIR%\\Temp\\~DFCA2C12CFB346F9AA.TMP","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%WINDIR%\\Temp\\~DF3D8DBB854EFA9510.TMP","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"path":"%WINDIR%\\Temp\\~DF163D2D316EEA6112.TMP","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]}]},"mutex_activity":{"mutex_created":[{"name":"Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"SM0:5880:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"Local\\SM0:5880:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]},{"name":"SM0:5880:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"648faa09512c2bab760fb499"}]}]}},"report_ids":{"sandbox_job_ids":["648faa09512c2bab760fb499"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 015151bd2d2b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 015151bd2d2b…. Threat score 100/100. 0/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 015151bd2d2b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 015151bd2d2b…. Threat score 100/100. 0/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/015151bd2d2bfb88389899bfac44b0e17a28db00abc8e1463058d84de40b1925"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 015151bd2d2b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 015151bd2d2b…. Threat score 100/100. 0/27 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6b","11",{}]]