"istry","RegQueryValueExW","FAILURE","","hKey->0x00000134","lpValueName->SeparateProcess" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000134","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x00000134","lpValueName->NoNetCrawling" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "2021" in Source: sample.bin, "777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001c8","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001cc","hKey->0x000001c8","lpSubKey->{a20cd692-8e41-11e1-9999-806d6172696f}\" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001cc","lpValueName->Generation" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","MoveFileWithProgressW","SUCCESS","","lpExistingFileName->C:\boot.ini.exe","lpNewFileName->C:\boot.ini" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","CreateFileW","SUCCESS","0x00000140","lpFileName->C:\CONFIG.SYS" in Source: sample.bin, "rrentVersion\Policies\Explorer" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000000e0","lpValueName->NoCommonGroups" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExA","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "202108162307" in Source: sample.bin, "PagedBuffers" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExA","SUCCESS","0x000000fc","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Rpc" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61\RpcThreadPoolThrottle" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Policies\Microsoft\Windows NT\Rpc" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","system","LoadLibraryW","SUCCESS","0x77e70000","lpFileName->rpcrt4.dll" "20210816230727.112","1352","34a3b17ad9ccc1812c4601" in Source: sample.bin, ","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001f4","lpValueName->AppData" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000001f4","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueExW","SUCCESS","","hKey->0x000001f4","lpValueName->AppData","dwType->1","lpData->C:\Documents and Settings\janettedoe\Application Data","cbData->108" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001f4","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS" in Source: sample.bin, "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x00000098","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x00000098","lpValueName->NoControlPanel" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x00000098","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x00000098","lpValueName->NoSetFolders" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExA","SUCCESS","0x0000009a","hKey->HKEY_CLASSES_ROOT","lpSubKey->CLSID\{20D04FE0-3AEA-1069-A2" in Source: sample.bin, "KEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x000000f8","lpValueName->NoWebView" Bind" in Source: sample.bin, "","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e8","lpValueName->SystemSetupInProgress" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SYSTEM\CurrentControlSet\Control\MiniNT" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->System\WPA\PnP" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e8","lpValueName->seed" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SYSTEM\Setup" "20210816230727.102","" in Source: sample.bin, "KEY_LOCAL_MACHINE","lpSubKey->SYSTEM\Setup" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->OsLoaderPath" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->OsLoaderPath" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000b4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SYSTEM\Setup" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->SystemPartition" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->SystemPartition" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000b4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Setup" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","S" in Source: sample.bin, "t->0x00000004" "20210816230722.045","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","memory","VirtualAllocEx","SUCCESS","0x00160000","th32ProcessID->1352","szExeFile->34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","lpAddress->0x00000000","dwSize->9998","flAllocationType->0x00001000","flProtect->0x00000004" "20210816230722.065","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","memory","VirtualAllocEx","SUCCESS","0x00160000","th32ProcessID->1352","szExeFile->34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","lpAddress->0x00000000","dwSize->26674","flAllocationType->0x00001000","flProtect->0x00000004" "20210816230722.075","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExA","FAILURE","","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Borland\Locales" "20210816230722.075","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","regist" in Source: sample.bin, "->0x00000000" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","device","DeviceIoControl","SUCCESS","","hDevice->0x00000124","dwIoControlCode->0x006d0034","lpInBuffer->0x0049cb30","nInBufferSize->0x00000208","lpOutBuffer->0x0049cd58","nOutBufferSize->0x00000010","lpBytesReturned->0x0120f884","lpOverlapped->0x00000000" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x00000124","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a20cd692-8e41-11e1-9999-806d6172696f}\" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueExW","SUCCESS","","hKey->0x00000124","lpValueName->BaseClass","dwType->1","lpData->Drive","cbData->12" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKe" in Source: sample.bin, "yExW","SUCCESS","0x00000124","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000138","hKey->0x00000124","lpSubKey->{a20cd692-8e41-11e1-9999-806d6172696f}\" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x00000138","lpValueName->Generation" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","system","LoadLibraryA","SUCCESS","0x7c9c0000","lpFileName->SHELL32.dll" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","system","LoadLibraryA","SUCCESS","0x774e0000","lpFileName->ole32.dll" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","Re" in Source: sample.bin, ","","hFile->0x000001d0","nNumberOfBytesToWrite->268" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000001d0","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001d0","lpValueName->Common Desktop" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000001d0","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueExW","SUCCESS","","hKey->0x000001d0","lpValueName->Common Desktop","dwType->1","lpData->C:\Documents and Settings\All Users\Des" in Source: sample.bin, "00001c0","lpFileName->C:\WINDOWS\Registration\R000000000007.clb","dwDesiredAccess->GENERIC_READ" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","ReadFile","SUCCESS","","hFile->0x000001c0","nNumberOfBytesToRead->22512" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001c0","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\COM3" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001c0","lpValueName->REGDBVersion" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","ReadFile","SUCCESS","","hFile->0x00000140","nNumberOfBytesToRead->61440" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","WriteFile","SUCCESS"," in Source: sample.bin, "0816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000134","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x00000134","lpValueName->NoSimpleStartMenu" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","DeleteFileW","SUCCESS","","lpFileName->C:\AUTOEXEC.BAT" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","MoveFileWithProgressW","SUCCESS","","lpExistingFileName->C:\AUTOEXEC.BAT.exe","lpNewFileName->C:\AUTOEXEC.BAT" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","CreateFileW","SUCCESS","0x00000134","lpFileName->C:\AutoRun.exe" in Source: sample.bin, "","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000134","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x00000134","lpValueName->ClassicShell" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000134","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","reg" in Source: sample.bin, "f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x00000212","lpValueName->DriveMask" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x00000210","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x00000210","lpValueName->Start Menu" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x00000210","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueExW","SUCCESS","","hKey->0x00000210","lpValueName->Start Menu","dwType->1" in Source: sample.bin, "UCCESS","","hKey->0x000000b4","lpValueName->SourcePath" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->SourcePath" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000b4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Setup" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->ServicePackSourcePath" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->ServicePackSourcePath" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000b4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Setup" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->ServicePackCachePath" "20200820232955" in Source: sample.bin, "Software\Microsoft\Notepad\DefaultFonts" in Source: sample.bin, "ubKey->System\CurrentControlSet\Control\ProductOptions" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001d4","lpValueName->ProductType" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001cc","hKey->0x000001dc","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001cc","lpValueName->Personal" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001cc","lpValueName->Local Settings" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS" in Source: sample.bin, "ry","RegOpenKeyExA","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Borland\Locales" "20210816230722.075","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExA","FAILURE","","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Borland\Delphi\Locales" "20210816230722.075","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","memory","VirtualAllocEx","SUCCESS","0x00150000","th32ProcessID->1352","szExeFile->34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","lpAddress->0x00000000","dwSize->1048576","flAllocationType->0x00002000","flProtect->0x00000001" "20210816230722.075","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","memory","VirtualAllocEx","SUCCESS","0x00150000","th32ProcessID->1352","szExeFile->34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","lpAddress->0x00150000","dwSize->16384","flAllocationType->0x00001000","flProtect->0x00000004" "20210816230722.0" in Source: sample.bin, "NE","lpSubKey->Software\Microsoft\COM3" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001b0","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\COM3" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001b8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Classes\CLSID" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001c0","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\COM3" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001c0","lpValueName->REGDBVersion" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","CreateFileW","SUCCESS","0x0" in Source: sample.bin, "tem","WriteFile","SUCCESS","","hFile->0x00000134","nNumberOfBytesToWrite->268" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000134","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x00000134","lpValueName->NoWebView" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.132" in Source: sample.bin, "soft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000000e0","lpValueName->NoInternetIcon" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExA","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\Cu" in Source: sample.bin, "puter" "20200820232954.995","1744","HelpMe.exe","1772","filesystem","CreateFileW","SUCCESS","0x000000b0","lpFileName->C:\WINDOWS\system32\HelpMe.exe","dwDesiredAccess->GENERIC_READ" "20200820232954.995","1744","HelpMe.exe","1772","filesystem","CopyFileExW","FAILURE","","lpExistingFileName->C:\WINDOWS\system32\HelpMe.exe","lpNewFileName->C:\AutoRun.exe" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x00000098","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x00000098","lpValueName->NoInternetIcon" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExA","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SOFTWARE\Micro" in Source: sample.bin, "","0x000001cc","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001dc","hKey->0x000001cc","lpSubKey->{a20cd692-8e41-11e1-9999-806d6172696f}\" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001dc","lpValueName->Generation" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","memory","VirtualAllocEx","SUCCESS","0x00164000","th32ProcessID->608","szExeFile->HelpMe.exe","lpAddress->0x00164000","dwSize->65536","flAllocationType->0x00001000","flProtect->0x00000004" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","ReadFile","SUCCESS","","hFile->0x00000140","nNumberOfBytesToRead->61440"" in Source: sample.bin, "D8-08002B30309D}\InProcServer32" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x0000009a","lpValueName->(null)" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000b4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->System\Setup" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->SystemSetupInProgress" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SYSTEM\CurrentControlSet\Control\MiniNT" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000b4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->System\WPA\PnP" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->seed" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000b4","hKey->H" in Source: sample.bin, "sc config TrustedInstaller start= disabled sc config AdobeARMservice start= disabled sc config FDResPub start= disabled sc config MozillaMaintenance start= disabled sc config MpsSvc start= disabled sc config wuauserv start= disabled sc config SSDPSRV start= disabled sc config windefend start= disabled sc config wsearch start= disabled sc config WMPNetworkSvc start= disabled sc config sppuinotify start= disabled netsh firewall set opmode mode=disable NetSh Advfirewall set allprofiles state off sc config NlaSvc start= disabled sc config gupdate start= disabled sc config gupdatem start= disabled sc config netprofm start= disabled sc config W32Time start= disabled sc config upnphost start= disabled sc config wdnissvc start= disabled sc config tiledatamodelsvc start= disabled sc config diagtrack start= disabled sc config dmwappushsvc start= disabled sc config UI0Detect start= disabled taskkill /f /im OneDrive.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpy" in Source: sample.bin, "ped->0x00000000" "20200820232955.085","1744","HelpMe.exe","1772","device","DeviceIoControl","SUCCESS","","hDevice->0x000000f0","dwIoControlCode->0x006d0008","lpInBuffer->0x00157af8","nInBufferSize->0x00000046","lpOutBuffer->0x00146030","nOutBufferSize->0x000000ee","lpBytesReturned->0x0121f374","lpOverlapped->0x00000000" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f4","hKey->0x000000f0","lpSubKey->{a20cd692-8e41-11e1-9999-806d6172696f}\" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000f4","lpValueName->Data" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f4","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\M" in Source: sample.bin, "gOpenKeyExW","SUCCESS","0x0000013a","hKey->HKEY_CLASSES_ROOT","lpSubKey->Directory" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->0x0000013a","lpSubKey->CurVer" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000126","hKey->0x0000013a","lpSubKey->(null)" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000138","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c0" in Source: sample.bin, "t" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x00000126","lpValueName->NeverShowExt" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000140","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x00000140","lpValueName->UseDesktopIniCache" "20210816230727.132","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","CreateFileW","SUCCE" in Source: sample.bin, "ActiveDesktopOn" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f8","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x000000f8","lpValueName->NoActiveDesktop" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\System" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f8","hKey->H" in Source: sample.bin, ".025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->ServicePackCachePath" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000b4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Setup" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->DriverCachePath" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->DriverCachePath" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000b4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000b4","lpValueName->DevicePath" "20200820232955.025","1744","HelpMe.exe","1772","synchronization","CreateMutexW","SUCCESS","0x000000b0","" in Source: sample.bin, "","0x000001dc","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows NT\CurrentVersion\winlogon" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000001dc","lpValueName->RsopDebugLevel" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001dc","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows NT\CurrentVersion\winlogon" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000001dc","lpValueName->UserEnvDebugLevel" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000001dc","lpValueName->RsopLogging" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf1" in Source: sample.bin, "f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000a8","hKey->0x000000c4","lpSubKey->Software\Microsoft\Windows\CurrentVersion\ThemeManager" "20210816230722.376","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000000a8","lpValueName->Compositing" "20210816230722.376","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000a8","hKey->0x000000c4","lpSubKey->Control Panel\Desktop" "20210816230722.376","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000000a8","lpValueName->LameButtonText" "20210816230722.376","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","system","LoadLibraryA","SUCCESS","0x5ad70000","lpFileName->uxtheme.dll" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","p" in Source: sample.bin, "" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->0x000001c2","lpSubKey->TreatAs" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000140","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001c8","hKey->0x00000140","lpSubKey->{a20cd692-8e41-11e1-9999-806d6172696f}\" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001c8","lpValueName->Generation" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001ca","hKey-" in Source: sample.bin, "xW","SUCCESS","","hKey->0x000001c8","lpValueName->Personal","dwType->1","lpData->C:\Documents and Settings\janettedoe\My Documents","cbData->100" "20210816230727.193","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001c8","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20210816230727.193","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000140","hKey->0x000001c8","lpSubKey->{a20cd692-8e41-11e1-9999-806d6172696f}\" "20210816230727.193","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x00000140","lpValueName->Generation" "20210816230727.193","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","DeleteFileW","SUCCESS","","lpFileName->C:\boot.ini" "20210816230727.203","1352"" in Source: sample.bin, "230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","system","LoadLibraryA","SUCCESS","0x76fd0000","lpFileName->CLBCATQ.DLL" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x0000014c","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Classes" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000158","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\COM3" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000168","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Classes" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000178","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\COM3" "202108" in Source: sample.bin, "16230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000180","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\COM3" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000188","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Classes\CLSID" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000190","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Classes" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000198","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\COM3" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001a8","hKey->HKEY_LOCAL_MACHI" in Source: sample.bin, ","1772","system","LoadLibraryA","SUCCESS","0x77920000","lpFileName->SETUPAPI.dll" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Rpc\PagedBuffers" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExA","SUCCESS","0x000000c8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Rpc" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HelpMe.exe\RpcThreadPoolThrottle" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Policies\Microsoft\Windows NT\Rpc" "20200820232955.025","1744","HelpMe.exe","1772","system","LoadLibraryW","SUCCESS","0x77e70000","lpFileName->rpcrt4.dll" "20200820232955.025","1744","HelpMe.exe","1772","filesystem","CreateFileW","SUCCESS","0x0" in Source: sample.bin, "ware /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockdown" /v bUpdater /t REG_DWORD /d 0 /f reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection /v AllowTelemetry /t REG_DWORD /d 0 /f %SystemRoot%\System32\OneDriveSetup.exe /uninstall %SystemRoot%\SysWOW64\OneDriveSetup.exe /uninstall echo "Done, rebooting" pause shutdown -r -t 10Bind" in Source: sample.bin, ">HKEY_CLASSES_ROOT","lpSubKey->Drive\shellex\FolderExtensions" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000142","hKey->HKEY_CLASSES_ROOT","lpSubKey->Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x00000142","lpValueName->DriveMask" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001c8","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727." in Source: sample.bin, "3","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","ReadFile","SUCCESS","","hFile->0x000001e0","nNumberOfBytesToRead->268" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","CreateFileW","SUCCESS","0x000001e0","lpFileName->C:\34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","dwDesiredAccess->GENERIC_READ" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","CreateFileW","SUCCESS","0x000001dc","lpFileName->C:\cuckoo\logs\1352.csv","dwDesiredAccess->GENERIC_READ" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000001f4","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816"" in Source: sample.bin, "xW","SUCCESS","0x000000bc","hKey->0x000000c0","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" "20210816230722.175","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000bc","lpValueName->Cache" "20210816230722.185","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","system","LoadLibraryA","SUCCESS","0x77dd0000","lpFileName->advapi32.dll" "20210816230722.195","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","process","CreateProcessInternalW","SUCCESS","608","lpApplicationName->(null)","lpCommandLine->C:\WINDOWS\system32\HelpMe.exe" "20210816230722.195","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","process","WinExec","SUCCESS","","lpCmdLine->C:\WINDOWS\system32\HelpMe.exe" "20210816230722.195","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","ReadFile","" in Source: sample.bin, "77af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000000e0","lpValueName->NoNetHood" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000000e0","lpValueName->NoPropertiesMyComputer" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Micro" in Source: sample.bin, "13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000140","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x00000140","lpValueName->ForceActiveDesktopOn" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000140","hKey->HKEY_CURRENT" in Source: sample.bin, "0x000000f8","nNumberOfBytesToWrite->35751" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","ReadFile","SUCCESS","","hFile->0x000000e4","nNumberOfBytesToRead->65536" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","CopyFileExW","SUCCESS","","lpExistingFileName->C:\34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","lpNewFileName->C:\AutoRun.exe" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","synchronization","CreateMutexW","SUCCESS","0x000000e4","lpName->(null)" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000fc","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Setup" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","regist" in Source: sample.bin, "xA","SUCCESS","","hKey->0x000000a4","lpValueName->CheckedValue","dwType->4","lpData->0","cbData->4" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegCreateKeyExW","SUCCESS","0x000000ac","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000ac","lpValueName->Startup" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegCreateKeyExW","SUCCESS","0x000000ac","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegSetValueExW","SUCCESS","","hKey->0x000000ac","lpValueName->Startup","dwType->1","lpData->C:\Documents and Settings\janettedoe\Start Menu\Programs\Startup","cbData->130" "20200820232954.995","1744","HelpMe.exe","1772","system","LoadLibraryA","SUCCESS","0x774e0000","lpFileName->ole32.dll" "20200820232954.995","1" in Source: sample.bin, "rocess","CreateRemoteThread","SUCCESS","0x000000c4","lpStartAddress->0x00404008","th32ProcessID->608","szExeFile->HelpMe.exe" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","process","CreateRemoteThread","SUCCESS","0x000000c8","lpStartAddress->0x00404008","th32ProcessID->608","szExeFile->HelpMe.exe" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000000d4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SoftWare\Microsoft\Windows NT\CurrentVersion\Winlogon" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueExA","SUCCESS","","hKey->0x000000d4","lpValueName->Shell","dwType->1","lpData->Explorer.exe HelpMe.exe","cbData->25" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000000d8","hKey->HKEY_LOCAL_MA" in Source: sample.bin, "3b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Policies\Microsoft\Windows\System" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001dc","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows NT\CurrentVersion\winlogon" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000001dc","lpValueName->UserEnvDebugLevel" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Policies\Microsoft\Windows\System" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","system","LoadLibraryW","SUCCESS","0x773d0000","lpFileName->comctl32.dll" "20210816230727.213","1352","34a3b17a" in Source: sample.bin, "osoft\Windows\CurrentVersion\Setup" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e8","lpValueName->DriverCachePath" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e8","lpValueName->DriverCachePath" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e8","lpValueName->DevicePath" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","synchronization","CreateMutexW","SUCCESS","0x000000ec","lpName->(nu" in Source: sample.bin, "ID->776","szExeFile->HelpMe.exe" "20200828233303.146","776","HelpMe.exe","148","process","CreateRemoteThread","SUCCESS","0x000000a0","lpStartAddress->0x00404008","th32ProcessID->776","szExeFile->HelpMe.exe" "20200828233303.157","776","HelpMe.exe","148","registry","RegCreateKeyExW","SUCCESS","0x000000a8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SoftWare\Microsoft\Windows NT\CurrentVersion\Winlogon" "20200828233303.157","776","HelpMe.exe","148","registry","RegSetValueExA","SUCCESS","","hKey->0x000000a8","lpValueName->Shell","dwType->1","lpData->Explorer.exe HelpMe.exe","cbData->25" "20200828233303.157","7 @shell32.dll,-34575 S-1-5-21-36506959-3032567584-731022457-1107 2 true imageres.dll,-1002 {7d49d726-3c21-4f05-99aa-fdc2c9474" in Source: sample.bin, "s\CurrentVersion\Explorer\MountPoints2\{a20cd692-8e41-11e1-9999-806d6172696f}\" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegSetValueExW","SUCCESS","","hKey->0x000000f0","lpValueName->BaseClass","dwType->1","lpData->Drive","cbData->12" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f4","hKey->0x000000f0","lpSubKey->{a20cd692-8e41-11e1-9999-806d6172696f}\" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000f4","lpValueName->Generation" "20200820232955.085","1744","HelpMe.exe","1772","system","LoadLibraryA","SUCCESS","0x7c9c0000","lpFileName->SHELL32.dll" "20200820232955.085","1744","HelpMe.exe","1772","system","LoadLibraryA","SUCCESS","0x774e0000","lpFileName->ole32.dll" "202008" in Source: sample.bin, "352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e8","lpValueName->ServicePackSourcePath" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Setup" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e8","lpValueName->ServicePackCachePath" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e8","lpValueName->ServicePackCachePath" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Micr" in Source: sample.bin, "","lpData->C:\Documents and Settings\janettedoe\Start Menu","cbData->96" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000210","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000204","hKey->0x00000210","lpSubKey->{a20cd692-8e41-11e1-9999-806d6172696f}\" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x00000204","lpValueName->Generation" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","memory","VirtualAllocEx","SUCCESS","0x00164000","th32ProcessID->608","szExeFile->HelpMe.exe","lpAddress->0x00164000","dwSize->65536","flAllocationType->0x00001000","f" in Source: sample.bin, "c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001d4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows NT\CurrentVersion\winlogon" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000001d4","lpValueName->UserEnvDebugLevel" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001d4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows NT\CurrentVersion\winlogon" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000001d4","lpValueName->ChkAccDebugLevel" "20210816230727.213","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001d4","hKey->HKEY_LOCAL_MACHINE","lpS" in Source: sample.bin, "S","0x0000013c","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000124","hKey->0x0000013c","lpSubKey->{a20cd692-8e41-11e1-9999-806d6172696f}\" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x00000124","lpValueName->Generation" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","CreateFileW","SUCCESS","0x00000124","lpFileName->\\.\MountPointManager","dwDesiredAccess->ATTRIBUTES" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","device","DeviceIoControl","FAILURE","","hDevice->0x00000124","dwIoControlCode->0x006d0034","lpInBuffer->0x0049cb30","nInBufferSize->0x00000208","lpOutBuffer-" in Source: sample.bin, "3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","WriteFile","SUCCESS","","hFile->0x000001e4","nNumberOfBytesToWrite->268" "20210816230727.223","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","DeleteFileW","SUCCESS","","lpFileName->C:\cuckoo\additional\.gitignore" "20210816230727.223","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001f4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->System\CurrentControlSet\Control\ProductOptions" "20210816230727.223","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001f4","lpValueName->ProductType" "20210816230727.223","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001f4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->System\CurrentControlSet\Services\LanmanServer\DefaultS" in Source: sample.bin, "f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000001cc","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001cc","lpValueName->Desktop" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000001cc","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueExW","SUCCESS","","hKey->0x000001cc","lpValueName->Desktop","dwType->1","lpData->C:\Documents and Settings\janettedoe\Desktop","cbData->90" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS" in Source: sample.bin, "32954.895","1744","HelpMe.exe","1772","process","CreateRemoteThread","SUCCESS","0x00000094","lpStartAddress->0x00404008","th32ProcessID->1744","szExeFile->HelpMe.exe" "20200820232954.895","1744","HelpMe.exe","1772","process","CreateRemoteThread","SUCCESS","0x00000098","lpStartAddress->0x00404008","th32ProcessID->1744","szExeFile->HelpMe.exe" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegCreateKeyExW","SUCCESS","0x000000a0","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SoftWare\Microsoft\Windows NT\CurrentVersion\Winlogon" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegSetValueExA","SUCCESS","","hKey->0x000000a0","lpValueName->Shell","dwType->1","lpData->Explorer.exe HelpMe.exe","cbData->25" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegCreateKeyExW","SUCCESS","0x000000a4","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegSetValueE" in Source: sample.bin, "ktop","cbData->88" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001d0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001c8","hKey->0x000001d0","lpSubKey->{a20cd692-8e41-11e1-9999-806d6172696f}\" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001c8","lpValueName->Generation" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001c8","hKey->0x00000138","lpSubKey->FileExts" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","" in Source: sample.bin, "Software\Microsoft\Notepad" in Source: sample.bin, "ry","RegQueryValueExW","SUCCESS","","hKey->0x000000fc","lpValueName->LogLevel" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000fc","lpValueName->LogLevel" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000000fc","lpValueName->LogPath" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->0x000000fc","lpSubKey->AppLogLevels" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","system","LoadLibraryA","SUCCESS","0x77920000","lpFileName->SETUPAPI.dll" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Rpc\" in Source: sample.bin, "6230727.172","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x0000014c","lpValueName->MinimumFreeMemPercentageToCreateProcess" "20210816230727.172","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x0000014c","lpValueName->MinimumFreeMemPercentageToCreateObject" "20210816230727.172","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","system","LoadLibraryA","SUCCESS","0x76fd0000","lpFileName->CLBCATQ.DLL" "20210816230727.172","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x0000014c","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\COM3" "20210816230727.172","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x0000014c","lpValueName->Com+Enabled" "20210816" in Source: sample.bin, "OutBufferSize->0x00000010","lpBytesReturned->0x0121f884","lpOverlapped->0x00000000" "20200820232955.085","1744","HelpMe.exe","1772","filesystem","CreateFileW","SUCCESS","0x000000f0","lpFileName->\\.\MountPointManager","dwDesiredAccess->ATTRIBUTES" "20200820232955.085","1744","HelpMe.exe","1772","device","DeviceIoControl","FAILURE","","hDevice->0x000000f0","dwIoControlCode->0x006d0034","lpInBuffer->0x00158b30","nInBufferSize->0x00000208","lpOutBuffer->0x00156060","nOutBufferSize->0x00000008","lpBytesReturned->0x0121f884","lpOverlapped->0x00000000" "20200820232955.085","1744","HelpMe.exe","1772","device","DeviceIoControl","SUCCESS","","hDevice->0x000000f0","dwIoControlCode->0x006d0034","lpInBuffer->0x00158b30","nInBufferSize->0x00000208","lpOutBuffer->0x00158d58","nOutBufferSize->0x00000010","lpBytesReturned->0x0121f884","lpOverlapped->0x00000000" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegCreateKeyExW","SUCCESS","0x000000f0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Window" in Source: sample.bin, "ice->0x00000124","dwIoControlCode->0x006d0008","lpInBuffer->0x0049bbf8","nInBufferSize->0x00000046","lpOutBuffer->0x00486100","nOutBufferSize->0x000000ee","lpBytesReturned->0x0120f374","lpOverlapped->0x00000000" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000124","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x0000013c","hKey->0x00000124","lpSubKey->{a20cd692-8e41-11e1-9999-806d6172696f}\" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x0000013c","lpValueName->Data" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCES" in Source: sample.bin, ""20200828233257.782","776","HelpMe.exe","148","registry","RegOpenKeyExA","FAILURE","","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Borland\Locales" "20200828233257.782","776","HelpMe.exe","148","registry","RegOpenKeyExA","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Borland\Locales" "20200828233257.782","776","HelpMe.exe","148","registry","RegOpenKeyExA","FAILURE","","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Borland\Delphi\Locales" "20200828233257.782","776","HelpMe.exe","148","memory","VirtualAllocEx","SUCCESS","0x01010000","th32ProcessID->776","szExeFile->HelpMe.exe","lpAddress->0x00000000","dwSize->1048576","flAllocationType->0x00002000","flProtect->0x00000001" "20200828233257.782","776","HelpMe.exe","148","memory","VirtualAllocEx","SUCCESS","0x01010000","th32ProcessID->776","szExeFile->HelpMe.exe","lpAddress->0x01010000","dwSize->16384","flAllocationType->0x00001000","flProtect->0x00000004" "20200828233257.802","776","HelpMe.exe","148","memory","VirtualAllocEx","SUCCESS","0x0099000" in Source: sample.bin, "CHINE","lpSubKey->SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueExA","SUCCESS","","hKey->0x000000d8","lpValueName->CheckedValue","dwType->4","lpData->0","cbData->4" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000000e0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e0","lpValueName->Startup" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000000e0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\Sh" in Source: sample.bin, "ell Folders" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueExW","SUCCESS","","hKey->0x000000e0","lpValueName->Startup","dwType->1","lpData->C:\Documents and Settings\janettedoe\Start Menu\Programs\Startup","cbData->130" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","system","LoadLibraryA","SUCCESS","0x774e0000","lpFileName->ole32.dll" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.102","1352","34a3b17ad9ccc1812c460148987" in Source: sample.bin, ","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000001c8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001c8","lpValueName->Common Documents" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000001c8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueExW","SUCCESS","","hKey->0x000001c8","lpValueName->Common Documents","dwType->1","lpData->C:\Documents and Settings\All Users\Documents","cbData->92" "20210816230727.203","1352","34a3b17ad9ccc1812c46014898" in Source: sample.bin, "e\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001e0","lpValueName->Common Start Menu" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000001e0","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueExW","SUCCESS","","hKey->0x000001e0","lpValueName->Common Start Menu","dwType->1","lpData->C:\Documents and Settings\All Users\Start Menu","cbData->94" "20210816230727.243","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000001e0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentV" in Source: sample.bin, "27.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000000e0","lpValueName->NoControlPanel" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","18" in Source: sample.bin, "c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Setup" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e8","lpValueName->SourcePath" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e8","lpValueName->SourcePath" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x000000e8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Setup" "20210816230727.102","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000e8","lpValueName->ServicePackSourcePath" "20210816230727.102","1" in Source: sample.bin, ">Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x00000210","lpValueName->Common AppData" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x00000210","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueExW","SUCCESS","","hKey->0x00000210","lpValueName->Common AppData","dwType->1","lpData->C:\Documents and Settings\All Users\Application Data","cbData->106" "20210816230727.253","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000210","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows" in Source: sample.bin, "25f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x00000138","lpValueName->DontShowSuperHidden" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000138","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x00000140","hKey->0x00000138","lpSubKey->(null)" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x00000140","lpValueName->ShellState" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x00000140","lpValueName->ShellState" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf" in Source: sample.bin, "_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x00000140","lpValueName->NoActiveDesktop" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\System" "20210816230727.112","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","memory","VirtualAllocEx","SUCCESS","0x00154000","th32ProcessID->1352","szExeFile->34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","lpAddress->0x00154000","dwSize->65536","flAllocationType->0x00001000","flProtect->0x00000004" "20210816230727.122","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","filesystem","ReadFile","SUCCESS","","hFile->0x0000012c","nN" in Source: sample.bin, "soft\Windows\CurrentVersion\ShellCompatibility\Applications\HelpMe.exe" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x00000098","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x00000098","lpValueName->NoCommonGroups" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExA","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "" in Source: sample.bin, "182","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","FAILURE","","hKey->0x000001c8","lpValueName->AllowFileCLSIDJunctions" "20210816230727.193","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000001c8","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" "20210816230727.193","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x000001c8","lpValueName->Personal" "20210816230727.193","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegCreateKeyExW","SUCCESS","0x000001c8","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" "20210816230727.193","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegSetValueE" in Source: sample.bin, "lpName->(null)" "20200820232955.025","1744","HelpMe.exe","1772","synchronization","CreateMutexW","SUCCESS","0x000000bc","lpName->(null)" "20200820232955.025","1744","HelpMe.exe","1772","synchronization","CreateMutexW","SUCCESS","0x000000c4","lpName->(null)" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000c8","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Setup" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000c8","lpValueName->LogLevel" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000c8","lpValueName->LogLevel" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x000000c8","lpValueName->LogPath" "20200820232955.025","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->0x000000c8","lpSubKey->AppLogLevels" "20200820232955.025","1744","HelpMe.exe"" in Source: sample.bin, "S","0x00aa0000","th32ProcessID->776","szExeFile->HelpMe.exe","lpAddress->0x00aa0000","dwSize->257","flAllocationType->0x00001000","flProtect->0x00000004" "20200828233257.832","776","HelpMe.exe","148","registry","RegOpenKeyExW","SUCCESS","0x00000088","hKey->0x0000009c","lpSubKey->Software\Microsoft\Windows\CurrentVersion\ThemeManager" "20200828233257.832","776","HelpMe.exe","148","registry","RegQueryValueExW","FAILURE","","hKey->0x00000088","lpValueName->Compositing" "20200828233257.852","776","HelpMe.exe","148","registry","RegOpenKeyExW","SUCCESS","0x00000088","hKey->0x0000009c","lpSubKey->Control Panel\Desktop" "20200828233257.852","776","HelpMe.exe","148","registry","RegQueryValueExW","FAILURE","","hKey->0x00000088","lpValueName->LameButtonText" "20200828233257.852","776","HelpMe.exe","148","system","LoadLibraryA","SUCCESS","0x5ad70000","lpFileName->uxtheme.dll" "20200828233303.146","776","HelpMe.exe","148","process","CreateRemoteThread","SUCCESS","0x0000009c","lpStartAddress->0x00404008","th32Process" in Source: sample.bin, "20232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f6","hKey->HKEY_CLASSES_ROOT","lpSubKey->Directory" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->0x000000f6","lpSubKey->CurVer" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f2","hKey->0x000000f6","lpSubKey->(null)" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f4","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x000000f4","lpValueName->DontShowSuperHidden" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x0" in Source: sample.bin, "744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000b0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x000000b0","lpValueName->NoNetHood" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000b0","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232954.995","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x000000b0","lpValueName->NoPropertiesMyCom" in Source: sample.bin, "00000f4","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Explorer" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f8","hKey->0x000000f4","lpSubKey->(null)" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000f8","lpValueName->ShellState" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegQueryValueExW","SUCCESS","","hKey->0x000000f8","lpValueName->ShellState" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x000000f8","hKey->HKEY_CURRENT_USER","lpSubKey->Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" "20200820232955.085","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x000000f8","lpValueName->Force" in Source: sample.bin, "a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x0000014c","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\COM3" "20210816230727.172","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegQueryValueExW","SUCCESS","","hKey->0x0000014c","lpValueName->Com+Enabled" "20210816230727.172","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\COM3\Debug" "20210816230727.172","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","FAILURE","","hKey->HKEY_LOCAL_MACHINE","lpSubKey->Software\Microsoft\COM3\Debug" "20210816230727.172","1352","34a3b17ad9ccc1812c46014898777af391c47cd32d3c025f3daadf13b55f4a61","1816","registry","RegOpenKeyExW","SUCCESS","0x0000014c","hKey->HKEY_LOCAL_MACHINE","lpSubKey->SOFTWARE\Microsoft\OLE" "2021081" in Source: sample.bin, "->0x00002000","flProtect->0x00000004" "20200820232949.888","1744","HelpMe.exe","1772","memory","VirtualAllocEx","SUCCESS","0x01220000","th32ProcessID->1744","szExeFile->HelpMe.exe","lpAddress->0x01220000","dwSize->257","flAllocationType->0x00001000","flProtect->0x00000004" "20200820232949.888","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x00000080","hKey->0x00000094","lpSubKey->Software\Microsoft\Windows\CurrentVersion\ThemeManager" "20200820232949.888","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x00000080","lpValueName->Compositing" "20200820232949.888","1744","HelpMe.exe","1772","registry","RegOpenKeyExW","SUCCESS","0x00000080","hKey->0x00000094","lpSubKey->Control Panel\Desktop" "20200820232949.888","1744","HelpMe.exe","1772","registry","RegQueryValueExW","FAILURE","","hKey->0x00000080","lpValueName->LameButtonText" "20200820232949.888","1744","HelpMe.exe","1772","system","LoadLibraryA","SUCCESS","0x5ad70000","lpFileName->uxtheme.dll" "202008202" in Source: sample.bin