26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 6d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TR/Redcap.zyeew Sample 6bb828d4ff16… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6bb828d4ff16…. Malware family: TR/Redcap.zyeew. Threat score 100/100. 3/28 AV engines flagged this file. 18 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6bb828d4ff1635fbb147f9a4accb3a083212ce9c730aec321a4038f0468d73ae","keywords":["Malicious","TR/Redcap.zyeew","malware analysis","sandbox report","threat intelligence","6bb828d4ff1635fbb147f9a4accb3a083212ce9c730aec321a4038f0468d73ae"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"6bb828d4ff1635fbb147f9a4accb3a083212ce9c730aec321a4038f0468d73ae","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TR/Redcap.zyeew","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":18,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T476,"file.exe" called "FindResourceA" with parameter "10949240" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "10949248" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "10949276" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "10949488" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "10949304" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "10949460" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "10949472" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "16447048" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "10949356" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "10949452" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "16447044" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "10949320" - (UID: 00000000-00005796) "file.exe" called "FindResourceA" with parameter "10949328" - (UID: 00000000-00005796)28:T9f6,"file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10995840'}" (UID: 00000000-00005796) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10995696'}" (UID: 00000000-00005796) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10995856'}" (UID: 00000000-00005796) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10995744'}" (UID: 00000000-00005796) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10995712'}" (UID: 00000000-00005796) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10995760'}" (UID: 00000000-00005796) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10995808'}" (UID: 00000000-00005796) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10995680'}" (UID: 00000000-00005796) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10995792'}" (UID: 00000000-00005796) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10995824'}" (UID: 00000000-00005796) "file.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '10995728'}" (UID: 00000000-00005796) "Uy3Um79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636544'}" (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636400'}" (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636560'}" (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636448'}" (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636416'}" (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636464'}" (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636512'}" (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636384'}" (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636496'}" (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636528'}" (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '8636480'}" (UID: 00000000-00004064)29:T985,"file.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00005796) "file.exe" called "RemoveDirectoryA" (UID: 00000000-00005796) "Uy3Um79.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00004064) "Uy3Um79.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00004064) "RD5bv98.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00003780) "RD5bv98.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00003780) "RD5bv98.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00003780) "RD5bv98.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP\ (UID: 00000000-00003780) "KA9Gi99.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007472) "KA9Gi99.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007472) "KA9Gi99.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007472) "KA9Gi99.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007472) "KA9Gi99.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP\ (UID: 00000000-00007472) "jX4dM01.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00003904) "jX4dM01.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00003904) "jX4dM01.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00003904) "jX4dM01.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00003904) "jX4dM01.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00003904) "jX4dM01.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP\ (UID: 00000000-00003904) "nB4kp89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP000.TMP (UID: 00000000-00007444) "nB4kp89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP001.TMP (UID: 00000000-00007444) "nB4kp89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP002.TMP (UID: 00000000-00007444) "nB4kp89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP003.TMP (UID: 00000000-00007444) "nB4kp89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP004.TMP (UID: 00000000-00007444) "nB4kp89.exe" called "RemoveDirectoryA" with parameter %TEMP%\IXP005.TMP (UID: 00000000-00007444)2a:T737,Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "file.exe") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")2b:T5e6,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "3Uv90uk.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "3Uv90uk.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "3Uv90uk.exe.3013844059") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "3Uv90uk.exe.3013844059") Found string "]_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "3Uv90uk.exe.3013844059") Found string "]_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "3Uv90uk.exe.3013844059") Found string "]_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found string "]_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp")2c:T12eb,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-72-00A718A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-72-00A718A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-42-00A7202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00005796-2841-42-00A7202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-42-00A7202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-15-00A71F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-15-00A71F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-65-00A753A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-65-00A753A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-37-00A73FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-37-00A73FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-73-00A717EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-73-00A717EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-22-00A7681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-22-00A7681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-71-00A72CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-71-00A72CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-29-00A752B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-29-00A752B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-26-00A724E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-26-00A724E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-62-00A755A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-62-00A755A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-60-00A7597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-60-00A7597D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005796-2841-31-00A72390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005796-2841-31-00A72390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-40-00A72267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-40-00A72267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-77-00A72773 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-77-00A72773 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005796-2841-52-00A74EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005796-2841-52-00A74EFD Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00005796-2841-36-00A73BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00005796-2841-36-00A73BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004064-5722-60-0083597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004064-5722-60-0083597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004064-5722-71-00832CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004064-5722-71-00832CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004064-5722-73-008317EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004064-5722-73-008317EE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004064-5722-78-00835C9E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004064-5722-78-00835C9E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004064-5722-41-00836495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004064-5722-41-00836495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004064-5722-57-00836298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004064-5722-57-00836298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004064-5722-16-008344B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004064-5722-16-008344B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004064-5722-22-0083681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004064-5722-22-0083681F2d:T40e,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)2e:T1d8c,"file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005796) "file.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005796) "Uy3Um79.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004064) "Uy3Um79.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004064) "RD5bv98.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003780) "RD5bv98.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003780) "KA9Gi99.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007472) "KA9Gi99.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007472) "jX4dM01.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003904) "jX4dM01.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003904) "nB4kp89.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007444) "nB4kp89.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007444)2f:Tbb7,"file.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007bff73a8a5490300000000f8f4fa00b444ff73a8a5490350f5fa006525ff73a8a549030100000025ad03d100000000ce30053a000000000300000004f6fa000a0000005818000048f6fa0080f5fa005b0000000300000008f5fa0010f5fa001cf8fa00e056ff733548f8a5feffffff5cf6fa0047f2fd73ce30053a00000000 (UID: 00000000-00005796) "Uy3Um79.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007bff7318ad6b030000000078f42701b444ff7318ad6b03d0f427016525ff7318ad6b0301000000c8a4e259000000000d6d702b000000000300000084f527010a000000dc0f0000c8f5270100f527015b0000000300000088f4270190f427019cf72701e056ff735840c42cfeffffffdcf5270147f2fd730d6d702b00000000 (UID: 00000000-00004064) "RD5bv98.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fa4e005c7bff7318ad9a020000000000fb4e00b444ff7318ad9a0258fb4e006525ff7318ad9a0201000000aa2813b9000000009b11e04000000000030000000cfc4e000a000000300f000050fc4e0088fb4e005d0000000300000010fb4e0018fb4e0020fe4e00e056ff73b2c35ccdfeffffff60fc4e0047f2fd739b11e040 (UID: 00000000-00003780) "KA9Gi99.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fbcc005c7bff73c89ef80200000000c0fbcc00b444ff73c89ef80218fccc006525ff73c89ef802010000005e9960190000000087b36c370000000003000000ccfccc000a000000641e000010fdcc0048fccc005b00000003000000d0fbcc00d8fbcc00e0fecc00e056ff730675ad6dfeffffff20fdcc0047f2fd7387b36c37 (UID: 00000000-00007472) "jX4dM01.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007bff7300aacd000000000060f99000b444ff7300aacd00b8f990006525ff7300aacd00010000008eb21e2e000000005ae33a2a00000000030000006cfa90000a000000980f0000b0fa9000e8f990005b0000000300000070f9900078f9900084fc9000e056ff73765b8f5afeffffffc4fa900047f2fd735ae33a2a00000000 (UID: 00000000-00003904) "nB4kp89.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000fb5e005c7bff73d09eb3000000000048fb5e00b444ff73d09eb300a0fb5e006525ff73d09eb30001000000d4899e540000000087b78b32000000000300000054fc5e000a000000a01e000098fc5e00d0fb5e005b0000000300000058fb5e0060fb5e0068fe5e00e056ff733462c120feffffffa8fc5e0047f2fd7387b78b32 (UID: 00000000-00007444) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000160000160852000050dc12031867100310000000785912030100000003000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d00 (UID: 00000000-00006524) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000003000000802500000200000000000000010000000c00000000000000000000000000000001000000010000000000000000000000720061006d00650000000000000000000000000000000000010000002f000000000000000000000063006f006e006600690067005c006d006100630000000000000065000000000000000000000000000000000000000000 (UID: 00000000-00006596)30:T81a,"file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Uy3Um79.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Uy3Um79.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "RD5bv98.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "RD5bv98.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "KA9Gi99.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "KA9Gi99.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "jX4dM01.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "jX4dM01.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "nB4kp89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "nB4kp89.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1qr25WJ5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1qr25WJ5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "AppLaunch.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2oG9025.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "3Uv90uk.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4oS510Xi.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")31:T637,"AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00006524-00000C15-54868168 "3Uv90uk.exe" queries volume information of "C:\" at 00000000-00003640-00000C15-56738103 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00006596-00000C15-90175517 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00006596-00000C15-90566321 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00006596-00000C15-90782399 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00006596-00000C15-92250215 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00006596-00000C15-95510471 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\cred64.dll" at 00000000-00008148-00000C15-118596365 "explothe.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\006700e5a2ab05\clip64.dll" at 00000000-00008148-00000C15-139469120 "cmd.exe" queries volume information of "C:\" at 00000000-00007484-00000C15-10067234432:T707,"file.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\Uy3Um79.exe" - (UID: 00000000-00005796) "Uy3Um79.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\RD5bv98.exe" - (UID: 00000000-00004064) "Uy3Um79.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\6gm5zN1.exe" - (UID: 00000000-00004064) "RD5bv98.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\KA9Gi99.exe" - (UID: 00000000-00003780) "RD5bv98.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\5ua1xu7.exe" - (UID: 00000000-00003780) "KA9Gi99.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\jX4dM01.exe" - (UID: 00000000-00007472) "KA9Gi99.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\4oS510Xi.exe" - (UID: 00000000-00007472) "jX4dM01.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\nB4kp89.exe" - (UID: 00000000-00003904) "jX4dM01.exe" called "CreateProcessA" with parameter "%TEMP%\IXP004.TMP\3Uv90uk.exe" - (UID: 00000000-00003904) "nB4kp89.exe" called "CreateProcessA" with parameter "%TEMP%\IXP005.TMP\1qr25WJ5.exe" - (UID: 00000000-00007444) "nB4kp89.exe" called "CreateProcessA" with parameter "%TEMP%\IXP005.TMP\2oG9025.exe" - (UID: 00000000-00007444) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login" - (UID: 00000000-00007484) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/" - (UID: 00000000-00007484) "cmd.exe" called "CreateProcessW" with parameter ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/" - (UID: 00000000-00007484)33:T5adf,"file.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005796) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005796) "file.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005796) "file.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005796) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005796) "file.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00005796) "file.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00005796) "Uy3Um79.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00004064) "Uy3Um79.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004064) "RD5bv98.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003780) "RD5bv98.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003780) "RD5bv98.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003780) "RD5bv98.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003780) "RD5bv98.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003780) "RD5bv98.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003780) "RD5bv98.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003780) "KA9Gi99.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007472) "KA9Gi99.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007472) "KA9Gi99.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007472) "KA9Gi99.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007472) "KA9Gi99.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007472) "KA9Gi99.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007472) "KA9Gi99.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007472) "jX4dM01.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003904) "jX4dM01.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003904) "jX4dM01.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003904) "jX4dM01.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003904) "jX4dM01.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003904) "jX4dM01.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003904) "jX4dM01.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003904) "nB4kp89.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007444) "nB4kp89.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007444) "nB4kp89.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007444) "nB4kp89.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007444) "nB4kp89.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00007444) "nB4kp89.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00007444) "nB4kp89.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00007444) "1qr25WJ5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007436) "1qr25WJ5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007436) "1qr25WJ5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007436) "1qr25WJ5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007436) "1qr25WJ5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007436) "1qr25WJ5.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007436) "1qr25WJ5.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007436) "1qr25WJ5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007436) "1qr25WJ5.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007436) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006524) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006524) "2oG9025.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006932) "2oG9025.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006932) "2oG9025.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006932) "2oG9025.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006932) "2oG9025.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006932) "2oG9025.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006932) "2oG9025.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006932) "2oG9025.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006932) "2oG9025.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006932) "3Uv90uk.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003640) "3Uv90uk.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003640) "3Uv90uk.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003640) "3Uv90uk.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003640) "3Uv90uk.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00003640) "3Uv90uk.exe" called "LoadLibrary" with a parameter Wininet.dll (UID: 00000000-00003640) "3Uv90uk.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003640) "4oS510Xi.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007500) "4oS510Xi.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007500) "4oS510Xi.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007500) "4oS510Xi.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007500) "4oS510Xi.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00007500) "4oS510Xi.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007500) "4oS510Xi.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007500) "4oS510Xi.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007500) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000944) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000944) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000944) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000944) "5ua1xu7.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006820) "5ua1xu7.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006820) "5ua1xu7.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006820) "5ua1xu7.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006820) "5ua1xu7.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00006820) "5ua1xu7.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006820) "5ua1xu7.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006820) "5ua1xu7.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006820) "5ua1xu7.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006820) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00006596) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00006596) "6gm5zN1.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007832) "6gm5zN1.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007832) "6gm5zN1.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007832) "6gm5zN1.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007832) "6gm5zN1.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007832) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008148) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008148) "7JT6bB79.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003788) "7JT6bB79.exe" called "LoadLibrary" with a parameter WINMM.DLL (UID: 00000000-00003788) "7JT6bB79.exe" called "LoadLibrary" with a parameter %TEMP%\IXP000.TMP\7JT6bB79.exe (UID: 00000000-00003788) "schtasks.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007104) "schtasks.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007104) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004796) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004796) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004796) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007484) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007484) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007484) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007484) "cmd.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00007484) "cmd.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00007484) "cmd.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00007484) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00007484) "cmd.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00007484) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00007484) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006952) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006952) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006952) "explothe.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006952) "explothe.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006952) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004268) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004268) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004268) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004268) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001524) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001524) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001524) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001492) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001492) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003948) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003948) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003948) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005960) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005960) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005540) "cacls.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005540)34:Tc7b,Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; File: "file.exe") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp, 00000000-00003640.00000000.67300.02DF0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02960000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessA,318,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")35:T74b,Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; File: "file.exe") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "RegCreateKeyExA" (Indicator: "RegCreateKey"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")36:T4d8,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "file.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "3Uv90uk.exe.3013844059") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")37:T960e,Found reference to API (Indicator: "CheckTokenMembership"; File: "file.exe") Found reference to API (Indicator: "HeapSetInformation"; File: "file.exe") Found reference to API (Indicator: "DecryptFileA"; File: "file.exe") Found reference to API (Indicator: "SHBrowseForFolder"; File: "file.exe") Found reference to API (Indicator: "SHGetPathFromIDList"; File: "file.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "file.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "file.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "file.exe") Found reference to API (Indicator: "RegQueryInfoKeyA"; File: "file.exe") Found reference to API (Indicator: "FreeSid"; File: "file.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "file.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "file.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "file.exe") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "file.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "file.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "file.exe") Found reference to API (Indicator: "EqualSid"; File: "file.exe") Found reference to API (Indicator: "RegCloseKey"; File: "file.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "file.exe") Found reference to API (Indicator: "GetShortPathNameA"; File: "file.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "file.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "file.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "file.exe") Found reference to API (Indicator: "FindNextFileA"; File: "file.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; File: "file.exe") Found reference to API (Indicator: "FindClose"; File: "file.exe") Found reference to API (Indicator: "LocalAlloc"; File: "file.exe") Found reference to API (Indicator: "lstrcmpA"; File: "file.exe") Found reference to API (Indicator: "CompareStringA"; File: "file.exe") Found reference to API (Indicator: "GetLastError"; File: "file.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "file.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "file.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "file.exe") Found reference to API (Indicator: "DeleteFileA"; File: "file.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "file.exe") Found reference to API (Indicator: "GlobalFree"; File: "file.exe") Found reference to API (Indicator: "CloseHandle"; File: "file.exe") Found reference to API (Indicator: "WritePrivateProfileStringA"; File: "file.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "file.exe") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "file.exe") Found reference to API (Indicator: "SetFileAttributesA"; File: "file.exe") Found reference to API (Indicator: "GetProcAddress"; File: "file.exe") Found reference to API (Indicator: "GlobalLock"; File: "file.exe") Found reference to API (Indicator: "LocalFree"; File: "file.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "file.exe") Found reference to API (Indicator: "FreeLibrary"; File: "file.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "file.exe") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "file.exe") Found reference to API (Indicator: "GetPrivateProfileStringA"; File: "file.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "file.exe") Found reference to API (Indicator: "ReadFile"; File: "file.exe") Found reference to API (Indicator: "SizeofResource"; File: "file.exe") Found reference to API (Indicator: "WriteFile"; File: "file.exe") Found reference to API (Indicator: "GetDriveTypeA"; File: "file.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "file.exe") Found reference to API (Indicator: "SetFileTime"; File: "file.exe") Found reference to API (Indicator: "SetFilePointer"; File: "file.exe") Found reference to API (Indicator: "FindResourceA"; File: "file.exe") Found reference to API (Indicator: "CreateMutexA"; File: "file.exe") Found reference to API (Indicator: "GetVolumeInformationA"; File: "file.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "file.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "file.exe") Found reference to API (Indicator: "FreeResource"; File: "file.exe") Found reference to API (Indicator: "GetVersion"; File: "file.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "file.exe") Found reference to API (Indicator: "GetTempPathA"; File: "file.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "file.exe") Found reference to API (Indicator: "CreateFileA"; File: "file.exe") Found reference to API (Indicator: "SetEvent"; File: "file.exe") Found reference to API (Indicator: "TerminateThread"; File: "file.exe") Found reference to API (Indicator: "GetVersionExA"; File: "file.exe") Found reference to API (Indicator: "LockResource"; File: "file.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "file.exe") Found reference to API (Indicator: "CreateThread"; File: "file.exe") Found reference to API (Indicator: "ResetEvent"; File: "file.exe") Found reference to API (Indicator: "LoadResource"; File: "file.exe") Found reference to API (Indicator: "ExitProcess"; File: "file.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "file.exe") Found reference to API (Indicator: "CreateProcessA"; File: "file.exe") Found reference to API (Indicator: "FormatMessageA"; File: "file.exe") Found reference to API (Indicator: "GetTempFileNameA"; File: "file.exe") Found reference to API (Indicator: "DosDateTimeToFileTime"; File: "file.exe") Found reference to API (Indicator: "CreateEventA"; File: "file.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "file.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "file.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "file.exe") Found reference to API (Indicator: "CharUpperA"; File: "file.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "file.exe") Found reference to API (Indicator: "MessageBeep"; File: "file.exe") Found reference to API (Indicator: "CharPrevA"; File: "file.exe") Found reference to API (Indicator: "LoadStringA"; File: "file.exe") Found reference to API (Indicator: "CharNextA"; File: "file.exe") Found reference to API (Indicator: "EnableWindow"; File: "file.exe") Found reference to API (Indicator: "ReleaseDC"; File: "file.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "file.exe") Found reference to API (Indicator: "PeekMessageA"; File: "file.exe") Found reference to API (Indicator: "SendMessageA"; File: "file.exe") Found reference to API (Indicator: "MessageBoxA"; File: "file.exe") Found reference to API (Indicator: "SetWindowTextA"; File: "file.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "file.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "file.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "file.exe") Found reference to API (Indicator: "ShowWindow"; File: "file.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "file.exe") Found reference to API (Indicator: "SetWindowPos"; File: "file.exe") Found reference to API (Indicator: "GetDC"; File: "file.exe") Found reference to API (Indicator: "GetWindowRect"; File: "file.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "file.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "file.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "file.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "file.exe") Found reference to API (Indicator: "Sleep"; File: "file.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "file.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file.exe") Found reference to API (Indicator: "TerminateProcess"; File: "file.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file.exe") Found reference to API (Indicator: "GetTickCount"; File: "file.exe") Found reference to API (Indicator: "EnumResourceLanguagesA"; File: "file.exe") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "file.exe") Found reference to API (Indicator: "MulDiv"; File: "file.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "file.exe") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00006820.00000000.68887.01031000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00006820.00000000.68887.01031000.00000020.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "FlsFree"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "FlsAlloc"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "LCMapStringEx"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "LocaleNameToLCID"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "VirtualFree"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "VirtualAlloc"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "InitializeSListHead"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "IsDebuggerPresent"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "RtlUnwind"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "SetLastError"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "EnterCriticalSection"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "LeaveCriticalSection"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "DeleteCriticalSection"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "TlsAlloc"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "TlsGetValue"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "TlsSetValue"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "TlsFree"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "LoadLibraryExW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "EncodePointer"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "RaiseException"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetStdHandle"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetModuleFileNameW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetModuleHandleExW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "HeapFree"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "HeapAlloc"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "HeapReAlloc"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "LCMapStringW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "FindFirstFileExW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "FindNextFileW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "IsValidCodePage"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetACP"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetOEMCP"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetCPInfo"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetCommandLineA"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetCommandLineW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "MultiByteToWideChar"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "WideCharToMultiByte"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "SetStdHandle"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetFileType"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetStringTypeW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetProcessHeap"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "HeapSize"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "FlushFileBuffers"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "GetConsoleMode"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "SetFilePointerEx"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "CreateFileW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "WriteConsoleW"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "DecodePointer"; File: "3Uv90uk.exe.3013844059") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003780.00000000.66756.00211000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003780.00000000.66756.00211000.00000020.mdmp") Found reference to API (Indicator: "DecryptFileA"; Source: "00000000-00003780.00000000.66756.00211000.00000020.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CharPrevA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")38:T44f,Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "file.exe") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "file.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "file.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "file.exe") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "file.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")39:T62a,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp")3a:T69e,"AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "2oG9025.exe" failed to load missing module "%WINDIR%\system32\oci.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]3b:T825,"file.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "Uy3Um79.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "RD5bv98.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "5ua1xu7.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "KA9Gi99.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "4oS510Xi.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "1qr25WJ5.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "jX4dM01.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "nB4kp89.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "2oG9025.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "6gm5zN1.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "3Uv90uk.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT3c:T4e7,Found string "https://www.youtube.com/" (Indicator: "youtube"; File: "file.exe") Found string "https://www.facebook.com/login" (Indicator: "facebook.com"; File: "file.exe") Found string "@shift /0start "" https://www.facebook.com/loginstart "" https://www.youtube.comstart "" https://accounts.google.com" (Indicator: "facebook.com"; File: "93D7.bat") file/memory contains long string with (Indicator: "youtube"; File: "urlref_httpswww.youtube.com") Found string "start "" https://www.facebook.com/login" (Indicator: "facebook.com"; File: "93D7.bat") Found string "start "" https://www.youtube.com" (Indicator: "youtube"; File: "93D7.bat") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login" (Indicator: "facebook.com"; Source: "00000000-00007484-00000C41-21229403618") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/" (Indicator: "youtube"; Source: "00000000-00007484-00000C41-32184358583") Found string "--single-argument https://www.facebook.com/login" (Indicator: "facebook.com"; File: "msedge.exe") Found string "--single-argument https://www.youtube.com/" (Indicator: "youtube"; File: "msedge.exe")3d:T56e6,"file.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "file.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "file.exe" loaded module "KERNEL32" at base 77070000 "file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "file.exe" loaded module "KERNEL32.DLL" at base 77070000 "file.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75320000 "file.exe" loaded module "FECLIENT.DLL" at base 73470000 "file.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73440000 "file.exe" loaded module "NTDLL.DLL" at base 77c00000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74570000 "Uy3Um79.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "Uy3Um79.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "Uy3Um79.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "Uy3Um79.exe" loaded module "KERNEL32" at base 77070000 "Uy3Um79.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "Uy3Um79.exe" loaded module "KERNEL32.DLL" at base 77070000 "Uy3Um79.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75320000 "Uy3Um79.exe" loaded module "FECLIENT.DLL" at base 73470000 "Uy3Um79.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73440000 "Uy3Um79.exe" loaded module "NTDLL.DLL" at base 77c00000 "Uy3Um79.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74570000 "RD5bv98.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "RD5bv98.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "RD5bv98.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "RD5bv98.exe" loaded module "KERNEL32" at base 77070000 "RD5bv98.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "RD5bv98.exe" loaded module "KERNEL32.DLL" at base 77070000 "RD5bv98.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75320000 "RD5bv98.exe" loaded module "FECLIENT.DLL" at base 73470000 "RD5bv98.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73440000 "RD5bv98.exe" loaded module "NTDLL.DLL" at base 77c00000 "RD5bv98.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74570000 "KA9Gi99.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "KA9Gi99.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "KA9Gi99.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "KA9Gi99.exe" loaded module "KERNEL32" at base 77070000 "KA9Gi99.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "KA9Gi99.exe" loaded module "KERNEL32.DLL" at base 77070000 "KA9Gi99.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75320000 "KA9Gi99.exe" loaded module "FECLIENT.DLL" at base 73470000 "KA9Gi99.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73440000 "KA9Gi99.exe" loaded module "NTDLL.DLL" at base 77c00000 "KA9Gi99.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74570000 "jX4dM01.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "jX4dM01.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "jX4dM01.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "jX4dM01.exe" loaded module "KERNEL32" at base 77070000 "jX4dM01.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "jX4dM01.exe" loaded module "KERNEL32.DLL" at base 77070000 "jX4dM01.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75320000 "jX4dM01.exe" loaded module "FECLIENT.DLL" at base 73470000 "jX4dM01.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73440000 "jX4dM01.exe" loaded module "NTDLL.DLL" at base 77c00000 "jX4dM01.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74570000 "nB4kp89.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "nB4kp89.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "nB4kp89.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "nB4kp89.exe" loaded module "KERNEL32" at base 77070000 "nB4kp89.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "nB4kp89.exe" loaded module "KERNEL32.DLL" at base 77070000 "nB4kp89.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75320000 "nB4kp89.exe" loaded module "FECLIENT.DLL" at base 73470000 "nB4kp89.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 73440000 "nB4kp89.exe" loaded module "NTDLL.DLL" at base 77c00000 "nB4kp89.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74570000 "1qr25WJ5.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "1qr25WJ5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "1qr25WJ5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "1qr25WJ5.exe" loaded module "KERNEL32" at base 77070000 "1qr25WJ5.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "1qr25WJ5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 774a0000 "1qr25WJ5.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 774a0000 "1qr25WJ5.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 774a0000 "1qr25WJ5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 774a0000 "1qr25WJ5.exe" loaded module "NTDLL.DLL" at base 77c00000 "1qr25WJ5.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74570000 "1qr25WJ5.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77050000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "AppLaunch.exe" loaded module "KERNEL32" at base 77070000 "AppLaunch.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 75320000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 73380000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 752d0000 "AppLaunch.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 77050000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74390000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72bd0000 "AppLaunch.exe" loaded module "USER32.DLL" at base 77a10000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 774a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 73410000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 759c0000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77060000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 77070000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 753a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 716f0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "AppLaunch.exe" loaded module "OLE32.DLL" at base 773a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 759c0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 774a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71660000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 70c00000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 74620000 "AppLaunch.exe" loaded module "ADVAPI32" at base 75320000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 77c00000 "2oG9025.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 28780000 "2oG9025.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 28780000 "2oG9025.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 28780000 "2oG9025.exe" loaded module "KERNEL32" at base 29400000 "2oG9025.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 1dcf0000 "2oG9025.exe" loaded module "KERNEL32.DLL" at base 29400000 "2oG9025.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 28780000 "2oG9025.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 28780000 "2oG9025.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 28780000 "2oG9025.exe" loaded module "NTDLL.DLL" at base 2b770000 "2oG9025.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 26100000 "2oG9025.exe" loaded module "%WINDIR%\SYSTEM32\COMSVCS.DLL" at base b7e0000 "2oG9025.exe" loaded module "RPCRT4.DLL" at base 2b200000 "2oG9025.exe" loaded module "%WINDIR%\SYSTEM32\OCI.DLL" at base 0 "2oG9025.exe" loaded module "MTXOCI.DLL" at base 1cda0000 "2oG9025.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 26f00000 "2oG9025.exe" loaded module "%WINDIR%\SYSTEM32\CMLUA.DLL" at base 1e070000 "2oG9025.exe" loaded module "SSPICLI.DLL" at base 279f0000 "2oG9025.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 27b30000 "3Uv90uk.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "3Uv90uk.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "3Uv90uk.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "3Uv90uk.exe" loaded module "KERNEL32" at base 77070000 "3Uv90uk.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "3Uv90uk.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 774a0000 "3Uv90uk.exe" loaded module "WININET.DLL" at base 70930000 "3Uv90uk.exe" loaded module "KERNEL32.DLL" at base 77070000 "3Uv90uk.exe" loaded module "RPCRT4.DLL" at base 753a0000 "3Uv90uk.exe" loaded module "SSPICLI.DLL" at base 74620000 "3Uv90uk.exe" loaded module "USER32.DLL" at base 77a10000 "3Uv90uk.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 73450000 "3Uv90uk.exe" loaded module "WINHTTP.DLL" at base 733a0000 "3Uv90uk.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 73450000 "3Uv90uk.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73340000 "3Uv90uk.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77b90000 "3Uv90uk.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77050000 "4oS510Xi.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "4oS510Xi.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "4oS510Xi.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "4oS510Xi.exe" loaded module "KERNEL32" at base 77070000 "4oS510Xi.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "4oS510Xi.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 774a0000 "4oS510Xi.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 774a0000 "4oS510Xi.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 774a0000 "4oS510Xi.exe" loaded module "NTDLL.DLL" at base 77c00000 "4oS510Xi.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74570000 "4oS510Xi.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77050000 "AppLaunch.exe" loaded module "USER32" at base 77a10000 "AppLaunch.exe" loaded module "SHELL32" at base 75c10000 "5ua1xu7.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "5ua1xu7.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "5ua1xu7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "5ua1xu7.exe" loaded module "KERNEL32" at base 77070000 "5ua1xu7.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "5ua1xu7.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 774a0000 "5ua1xu7.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 774a0000 "5ua1xu7.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 774a0000 "5ua1xu7.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 774a0000 "5ua1xu7.exe" loaded module "NTDLL.DLL" at base 77c00000 "5ua1xu7.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74570000 "5ua1xu7.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77050000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 730b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 72900000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 713a0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74060000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 71310000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 708b0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 74060000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 70090000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6ff80000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f800000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 75c10000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 73900000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6f790000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 756b0000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 6f670000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 75990000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 6ee40000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77330000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 6e200000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\UCRTBASE_CLR0400.DLL" at base 0 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 72830000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\PRESENTATIONCORE\V4.0_4.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 6f3f0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 774a0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 774a0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "6gm5zN1.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "6gm5zN1.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "6gm5zN1.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "6gm5zN1.exe" loaded module "KERNEL32" at base 77070000 "6gm5zN1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "6gm5zN1.exe" loaded module "KERNEL32.DLL" at base 77070000 "6gm5zN1.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74060000 "6gm5zN1.exe" loaded module "NTDLL.DLL" at base 77c00000 "6gm5zN1.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b30000 "6gm5zN1.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 747b0000 "6gm5zN1.exe" loaded module "SHELL32.DLL" at base 75c10000 "6gm5zN1.exe" loaded module "RPCRT4.DLL" at base 753a0000 "6gm5zN1.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6f700000 "6gm5zN1.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75c10000 "6gm5zN1.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77070000 "6gm5zN1.exe" loaded module "USER32.DLL" at base 77a10000 "6gm5zN1.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 6f4e0000 "6gm5zN1.exe" loaded module "MSISO.DLL" at base 6f260000 "6gm5zN1.exe" loaded module "SSPICLI.DLL" at base 74620000 "6gm5zN1.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 774a0000 "6gm5zN1.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74570000 "6gm5zN1.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77050000 "explothe.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "explothe.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "explothe.exe" loaded module "KERNEL32.DLL" at base 77070000 "explothe.exe" loaded module "RPCRT4.DLL" at base 753a0000 "explothe.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6ca40000 "explothe.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77070000 "explothe.exe" loaded module "SHELL32.DLL" at base 75c10000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 6c0e0000 "explothe.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 77b90000 "7JT6bB79.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "7JT6bB79.exe" loaded module "WINMM.DLL" at base 72800000 "7JT6bB79.exe" loaded module "KERNEL32.DLL" at base 77070000 "7JT6bB79.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b30000 "7JT6bB79.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75c10000 "7JT6bB79.exe" loaded module "USER32.DLL" at base 77a10000 "schtasks.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "schtasks.exe" loaded module "KERNEL32" at base 77070000 "schtasks.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "schtasks.exe" loaded module "KERNEL32.DLL" at base 77070000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 753a0000 "schtasks.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73a40000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74620000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "cmd.exe" loaded module "KERNEL32" at base 77070000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 77070000 "cmd.exe" loaded module "NTDLL.DLL" at base 77c00000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74570000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 28780000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 28780000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 28780000 "cmd.exe" loaded module "KERNEL32" at base 29400000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 1ecc0000 "cmd.exe" loaded module "COMCTL32.DLL" at base 18400000 "cmd.exe" loaded module "KERNEL32.DLL" at base 29400000 "cmd.exe" loaded module "RPCRT4.DLL" at base 2b200000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 23c80000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SHELL.SERVICEHOSTBUILDER.DLL" at base 164f0000 "cmd.exe" loaded module "PROPSYS.DLL" at base 220f0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 220f0000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 290f0000 "cmd.exe" loaded module "SECUR32.DLL" at base 22a40000 "cmd.exe" loaded module "SSPICLI.DLL" at base 279f0000 "cmd.exe" loaded module "MLANG.DLL" at base f060000 "cmd.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 2b630000 "cmd.exe" loaded module "WININET.DLL" at base 180c0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.APPDEFAULTS.DLL" at base 20d10000 "cmd.exe" loaded module "NTDLL.DLL" at base 2b770000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 25ec0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6cd0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\SFC_OS.DLL" at base 1ed30000 "explothe.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "explothe.exe" loaded module "KERNEL32" at base 77070000 "explothe.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "explothe.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77050000 "cacls.exe" loaded module "KERNEL32" at base 77070000 "cacls.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 774a0000 "cacls.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 774a0000 "cacls.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 774a0000 "cacls.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 756b0000 "cacls.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 774a0000 "cacls.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 774a0000 "cacls.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 774a0000 "cacls.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cb0000 "cacls.exe" loaded module "RPCRT4.DLL" at base 753a0000 "cacls.exe" loaded module "KERNEL32.DLL" at base 770700003e:T6f0,"file.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77330000 "file.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73900000 "Uy3Um79.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77330000 "Uy3Um79.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73900000 "RD5bv98.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77330000 "RD5bv98.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73900000 "KA9Gi99.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77330000 "KA9Gi99.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73900000 "jX4dM01.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77330000 "jX4dM01.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73900000 "nB4kp89.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77330000 "nB4kp89.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73900000 "1qr25WJ5.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77330000 "1qr25WJ5.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73900000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77330000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73900000 "2oG9025.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 289F0000 "2oG9025.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 275C0000 "3Uv90uk.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77330000 "3Uv90uk.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73900000 "4oS510Xi.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77330000 "4oS510Xi.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73900000 "5ua1xu7.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 773300003f:T4be,"file.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "Uy3Um79.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "RD5bv98.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "KA9Gi99.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "jX4dM01.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "nB4kp89.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "1qr25WJ5.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "AppLaunch.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "2oG9025.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 2B200000 "3Uv90uk.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "4oS510Xi.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "5ua1xu7.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "6gm5zN1.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "explothe.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "cmd.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 2B200000 "cmd.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A0000 "cacls.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 753A000040:T12fc,"file.exe" was detected as "Microsoft Cabinet" and name: "sfx" "file.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "file.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "file.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "file.exe" was detected as "Microsoft Linker" and name: "Linker" "Uy3Um79.exe" was detected as "Microsoft Cabinet" and name: "sfx" "Uy3Um79.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Uy3Um79.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Uy3Um79.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "Uy3Um79.exe" was detected as "Microsoft Linker" and name: "Linker" "RD5bv98.exe" was detected as "Microsoft Cabinet" and name: "sfx" "RD5bv98.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "RD5bv98.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "RD5bv98.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "RD5bv98.exe" was detected as "Microsoft Linker" and name: "Linker" "5ua1xu7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5ua1xu7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5ua1xu7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5ua1xu7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5ua1xu7.exe" was detected as "Microsoft Linker" and name: "Linker" "KA9Gi99.exe" was detected as "Microsoft Cabinet" and name: "sfx" "KA9Gi99.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "KA9Gi99.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "KA9Gi99.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "KA9Gi99.exe" was detected as "Microsoft Linker" and name: "Linker" "4oS510Xi.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4oS510Xi.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4oS510Xi.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4oS510Xi.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4oS510Xi.exe" was detected as "Microsoft Linker" and name: "Linker" "1qr25WJ5.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1qr25WJ5.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1qr25WJ5.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1qr25WJ5.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1qr25WJ5.exe" was detected as "Microsoft Linker" and name: "Linker" "jX4dM01.exe" was detected as "Microsoft Cabinet" and name: "sfx" "jX4dM01.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "jX4dM01.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "jX4dM01.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "jX4dM01.exe" was detected as "Microsoft Linker" and name: "Linker" "nB4kp89.exe" was detected as "Microsoft Cabinet" and name: "sfx" "nB4kp89.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "nB4kp89.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "nB4kp89.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "nB4kp89.exe" was detected as "Microsoft Linker" and name: "Linker" "2oG9025.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2oG9025.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2oG9025.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2oG9025.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2oG9025.exe" was detected as "Microsoft Linker" and name: "Linker" "6gm5zN1.exe" was detected as "Microsoft Cabinet" and name: "sfx" "6gm5zN1.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "6gm5zN1.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "6gm5zN1.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "6gm5zN1.exe" was detected as "Microsoft Linker" and name: "Linker" "3Uv90uk.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3Uv90uk.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3Uv90uk.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3Uv90uk.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3Uv90uk.exe" was detected as "Microsoft Linker" and name: "Linker" "7JT6bB79.exe" was detected as "Microsoft Cabinet" and name: "sfx" "7JT6bB79.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "7JT6bB79.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7JT6bB79.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "7JT6bB79.exe" was detected as "Microsoft Linker" and name: "Linker"41:Tf64,"2oG9025.exe" touched "New Moniker" (Path: "HKCU\CLSID\{ECABAFC6-7F19-11D2-978E-0000F8757E2A}") "2oG9025.exe" touched "CMSTPLUA" (Path: "HKCU\CLSID\{3E5FC7F9-9A51-4367-9063-A120244FBEC7}\TREATAS") "2oG9025.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{6EDD6D74-C007-4E75-B76A-E5740995E24C}\TREATAS") "6gm5zN1.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "6gm5zN1.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "6gm5zN1.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "6gm5zN1.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "6gm5zN1.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "6gm5zN1.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "6gm5zN1.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "6gm5zN1.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "6gm5zN1.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "6gm5zN1.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "6gm5zN1.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "6gm5zN1.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "6gm5zN1.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "explothe.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "explothe.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "explothe.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "explothe.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "explothe.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "explothe.exe" touched "Other Users Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "explothe.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "explothe.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\SHELLFOLDER") "schtasks.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}") "cmd.exe" touched "Internet Shortcut" (Path: "HKCU\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\INPROCHANDLER32") "cmd.exe" touched "Microsoft Url History Service" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS")42:T455,"file.exe" has an writable section named ".data" "Uy3Um79.exe" has an writable section named ".data" "RD5bv98.exe" has an writable section named ".data" "5ua1xu7.exe" has an writable section named ".data" "5ua1xu7.exe" has an writable section named ".css" "5ua1xu7.exe" has an writable section named ".111" "KA9Gi99.exe" has an writable section named ".data" "4oS510Xi.exe" has an writable section named ".data" "4oS510Xi.exe" has an writable section named ".css" "4oS510Xi.exe" has an writable section named ".111" "1qr25WJ5.exe" has an writable section named ".data" "1qr25WJ5.exe" has an writable section named ".css" "1qr25WJ5.exe" has an writable section named ".111" "jX4dM01.exe" has an writable section named ".data" "nB4kp89.exe" has an writable section named ".data" "2oG9025.exe" has an writable section named ".data" "6gm5zN1.exe" has an writable section named ".data" "3Uv90uk.exe" has an writable section named ".data" "7JT6bB79.exe" has an writable section named "UPX0" "7JT6bB79.exe" has an writable section named "UPX1" "7JT6bB79.exe" has an writable section named ".rsrc"43:T19f0,"file.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "Uy3Um79.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "RD5bv98.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "5ua1xu7.exe" file has an entrypoint instructions - "jmp 0x440936,jmp 0x457916,jmp 0x448fc0,jmp 0x4336b9,jmp 0x41d9f9,jmp 0x4a2ed0,jmp 0x433c5a,jmp 0x4586f9,jmp 0x4aabf9,jmp 0x4182e4,jmp 0x441a98,jmp 0x451960,jmp 0x429414,jmp 0x452bb8,jmp 0x419c99,jmp 0x417903,jmp 0x48ffdf,jmp 0x411cb0,jmp 0x452e49,jmp 0x46fca4," "KA9Gi99.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4oS510Xi.exe" file has an entrypoint instructions - "jmp 0x440926,jmp 0x457906,jmp 0x448fb0,jmp 0x4336a9,jmp 0x41d9e9,jmp 0x4a2ec0,jmp 0x433c4a,jmp 0x4586e9,jmp 0x4aabe9,jmp 0x4182d4,jmp 0x441a88,jmp 0x451950,jmp 0x429404,jmp 0x452ba8,jmp 0x419c89,jmp 0x4178f3,jmp 0x48ffcf,jmp 0x411cb0,jmp 0x452e39,jmp 0x46fc94," "1qr25WJ5.exe" file has an entrypoint instructions - "jmp 0x440926,jmp 0x457906,jmp 0x448fb0,jmp 0x4336a9,jmp 0x41d9e9,jmp 0x4a2ec0,jmp 0x433c4a,jmp 0x4586e9,jmp 0x4aabe9,jmp 0x4182d4,jmp 0x441a88,jmp 0x451950,jmp 0x429404,jmp 0x452ba8,jmp 0x419c89,jmp 0x4178f3,jmp 0x48ffcf,jmp 0x411cb0,jmp 0x452e39,jmp 0x46fc94," "jX4dM01.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "nB4kp89.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "2oG9025.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000b078,add rsp, 0x28,jmp 0x14000a63c,int3 ,int3 ,sub rsp, 0x28,call 0x14000b41c,test eax, eax,je 0x14000a7fa,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x14000a7ed,cmp rcx, rax,je 0x14000a801,xor eax, eax,lock cmpxchg qword ptr [rip + 0x35e70], rcx,jne 0x14000a7e8,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x14000a7fc,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,movzx eax, byte ptr [rip + 0x35e5b],test ecx, ecx,mov ebx, 1," "6gm5zN1.exe" file has an entrypoint instructions - "call 0x414888,jmp 0x41427f,jmp 0x4186fa,push ebp,mov ebp, esp,sub esp, 0x324,push ebx,push 0x17,call 0x4273e3,test eax, eax,je 0x41442a,mov ecx, dword ptr [ebp + 8],int 0x29,push 3,call 0x4145d7,mov dword ptr [esp], 0x2cc,lea eax, [ebp - 0x324],push 0,push eax,call 0x414ec0,add esp, 0xc,mov dword ptr [ebp - 0x274], eax,mov dword ptr [ebp - 0x278], ecx,mov dword ptr [ebp - 0x27c], edx,mov dword ptr [ebp - 0x280], ebx," "3Uv90uk.exe" file has an entrypoint instructions - "call 0x4014e9,jmp 0x4010c5,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],push esi,mov ecx, dword ptr [eax + 0x3c],add ecx, eax,movzx eax, word ptr [ecx + 0x14],lea edx, [ecx + 0x18],add edx, eax,movzx eax, word ptr [ecx + 6],imul esi, eax, 0x28,add esi, edx,cmp edx, esi,je 0x401286,mov ecx, dword ptr [ebp + 0xc],cmp ecx, dword ptr [edx + 0xc],jb 0x40127f,mov eax, dword ptr [edx + 8],add eax, dword ptr [edx + 0xc],cmp ecx, eax,jb 0x40128b,add edx, 0x28,cmp edx, esi,jne 0x401270,xor eax, eax,pop esi,pop ebp,ret ,mov eax, edx,jmp 0x401288,push esi,call 0x401a29,test eax, eax,je 0x4012b9,mov eax, dword ptr fs:[0x18],mov esi, 0x42bd74," "7JT6bB79.exe" file has an entrypoint instructions - "pushal ,mov esi, 0x412015,lea edi, [esi - 0x11015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x41bca8,inc esi,inc esi,push ebx,push 0x19a62,push edi,add ebx, 4,push ebx,push 0x9c78,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax,"44:T12db,Process "Uy3Um79.exe" (UID: 00000000-00004064) was launched with new environment variables: "__COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "Uy3Um79.exe" (UID: 00000000-00004064) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "cmd.exe" (UID: 00000000-00007484) was launched with new environment variables: "b2eincfilepath="%TEMP%\IXP000.TMP"" Process "explothe.exe" (UID: 00000000-00006952) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "explothe.exe" (UID: 00000000-00006952) was launched with missing environment variables: "__COMPAT_LAYER, b2eincfilepath, PROCESSOR_ARCHITEW6432" Process "cmd.exe" (UID: 00000000-00004268) was launched with new environment variables: "PROMPT="$P$G", __COMPAT_LAYER="ElevateCreateProcess WRPMitigation", PROCESSOR_ARCHITEW6432="AMD64"" Process "cmd.exe" (UID: 00000000-00004268) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "msedge.exe" (UID: 00000000-00001512) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", b2eincfilepath="%TEMP%\IXP000.TMP", FPS_BROWSER_USER_PROFILE_STRING="Default"" Process "msedge.exe" (UID: 00000000-00001512) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00001512) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00001788) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_1512_LKXJNOCVHDYERDNS", EDGE_BROWSER_PID="1512"" Process "msedge.exe" (UID: 00000000-00006860) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="22", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="-4711029798805263534"" Process "cacls.exe" (UID: 00000000-00005540) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "cacls.exe" (UID: 00000000-00005540) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "cacls.exe" (UID: 00000000-00005540) was launched with missing environment variables: "FPS_BROWSER_APP_PROFILE_STRING, EDGE_METRICS_SESSION_ID, b2eincfilepath, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, FPS_BROWSER_USER_PROFILE_STRING, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00005732) was launched with new environment variables: "FPS_BROWSER_APP_PROFILE_STRING="Internet Explorer", EDGE_METRICS_SESSION_ID="22", b2eincfilepath="%TEMP%\IXP000.TMP", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_1512_LKXJNOCVHDYERDNS", FPS_BROWSER_USER_PROFILE_STRING="Default", EDGE_METRICS_CLIENT_ID_HASH="-4711029798805263534", EDGE_BROWSER_PID="1512"" Process "msedge.exe" (UID: 00000000-00005732) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles" Process "msedge.exe" (UID: 00000000-00005732) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00004956) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00004736) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_4956_UHRMNHUZXGKPCVHB", EDGE_BROWSER_PID="4956"" Process "msedge.exe" (UID: 00000000-00002960) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="23", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="-4711029798805263534"" Process "msedge.exe" (UID: 00000000-00000764) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, EDGE_USER_DATA_DIR, CHROME_CRASHPAD_PIPE_NAME, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00001168) was launched with new environment variables: "CHROME_CRASHPAD_PIPE_NAME="\\.\pipe\LOCAL\crashpad_764_FKPIEKCPNOCECPOU", EDGE_BROWSER_PID="764"" Process "msedge.exe" (UID: 00000000-00006776) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="23", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="-4711029798805263534"" Process "msedge.exe" (UID: 00000000-00005608) was launched with modified environment variables: "EDGE_METRICS_SESSION_ID, EDGE_METRICS_CLIENT_ID_HASH"45:T6b0,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Uy3Um79.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Uy3Um79.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Uy3Um79.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "RD5bv98.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "RD5bv98.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "RD5bv98.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "KA9Gi99.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "KA9Gi99.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "KA9Gi99.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "jX4dM01.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "jX4dM01.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "jX4dM01.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "nB4kp89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "nB4kp89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "nB4kp89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1qr25WJ5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")46:T103e,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: AppLaunch.exe.log] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00005796-00000C25-46576192] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00005796-00000C25-46718162] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00005796-00000BC1-46749056] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00004064-00000BC1-47462668] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00003780-00000BC1-48405164] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00007472-00000BC1-49117420] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP004.TMP\"" [Source: 00000000-00003904-00000BC1-49676969] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP005.TMP\"" [Source: 00000000-00007444-00000BC1-50459363] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00006524-00000C25-52915064] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00006524-00000C25-53958550] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00006524-00000C25-54292112] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006524-00000C25-54456295] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00006524-00000C25-54786555] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00006524-00000C25-54885851] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006524-00000C25-54953444] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00006524-00000C25-55090222] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00006524-00000C25-55162002] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00006524-00000C25-55810666] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00006596-00000C25-90620405] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00006596-00000C25-90969280] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00006596-00000C25-91284384] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00006596-00000C25-91328450] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00006596-00000C25-91433892]47:T76f,Spawned process "Uy3Um79.exe" (UID: 00000000-00004064) Spawned process "RD5bv98.exe" (UID: 00000000-00003780) Spawned process "KA9Gi99.exe" (UID: 00000000-00007472) Spawned process "jX4dM01.exe" (UID: 00000000-00003904) Spawned process "nB4kp89.exe" (UID: 00000000-00007444) Spawned process "1qr25WJ5.exe" (UID: 00000000-00007436) Spawned process "AppLaunch.exe" (UID: 00000000-00006524) Spawned process "2oG9025.exe" (UID: 00000000-00006932) Spawned process "3Uv90uk.exe" (UID: 00000000-00003640) Spawned process "4oS510Xi.exe" (UID: 00000000-00007500) Spawned process "AppLaunch.exe" (UID: 00000000-00000944) Spawned process "5ua1xu7.exe" (UID: 00000000-00006820) Spawned process "AppLaunch.exe" (UID: 00000000-00005848) Spawned process "AppLaunch.exe" (UID: 00000000-00006596) Spawned process "6gm5zN1.exe" (UID: 00000000-00007832) Spawned process "explothe.exe" (UID: 00000000-00008148) Spawned process "7JT6bB79.exe" (UID: 00000000-00003788) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00007104), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "VdkQz3E:N"&&CACLS "explothe.e ..." (UID: 00000000-00004796) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\93D5.tmp\\93D6.tmp\\93D7.bat %TEMP%\\IXP000.TMP\\7JT ..." (UID: 00000000-00007484), Spawned process "explothe.exe" (UID: 00000000-00006952), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00004268), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "VdkQz3E:N"" (UID: 00000000-00001524), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "VdkQz3E:R" /E" (UID: 00000000-00001492), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00003948)48:T76f,Spawned process "Uy3Um79.exe" (UID: 00000000-00004064) Spawned process "RD5bv98.exe" (UID: 00000000-00003780) Spawned process "KA9Gi99.exe" (UID: 00000000-00007472) Spawned process "jX4dM01.exe" (UID: 00000000-00003904) Spawned process "nB4kp89.exe" (UID: 00000000-00007444) Spawned process "1qr25WJ5.exe" (UID: 00000000-00007436) Spawned process "AppLaunch.exe" (UID: 00000000-00006524) Spawned process "2oG9025.exe" (UID: 00000000-00006932) Spawned process "3Uv90uk.exe" (UID: 00000000-00003640) Spawned process "4oS510Xi.exe" (UID: 00000000-00007500) Spawned process "AppLaunch.exe" (UID: 00000000-00000944) Spawned process "5ua1xu7.exe" (UID: 00000000-00006820) Spawned process "AppLaunch.exe" (UID: 00000000-00005848) Spawned process "AppLaunch.exe" (UID: 00000000-00006596) Spawned process "6gm5zN1.exe" (UID: 00000000-00007832) Spawned process "explothe.exe" (UID: 00000000-00008148) Spawned process "7JT6bB79.exe" (UID: 00000000-00003788) Spawned process "schtasks.exe" with commandline "/Create /SC MINUTE /MO 1 /TN explothe.exe /TR "%TEMP%\\fefffe8ce ..." (UID: 00000000-00007104), Spawned process "cmd.exe" with commandline "/k echo Y|CACLS "explothe.exe" /P "VdkQz3E:N"&&CACLS "explothe.e ..." (UID: 00000000-00004796) Spawned process "cmd.exe" with commandline "/c "%TEMP%\\93D5.tmp\\93D6.tmp\\93D7.bat %TEMP%\\IXP000.TMP\\7JT ..." (UID: 00000000-00007484), Spawned process "explothe.exe" (UID: 00000000-00006952), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00004268), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "VdkQz3E:N"" (UID: 00000000-00001524), Spawned process "cacls.exe" with commandline "CACLS "explothe.exe" /P "VdkQz3E:R" /E" (UID: 00000000-00001492), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /S /D /c" echo Y"" (UID: 00000000-00003948)49:Tfed,"Uy3Um79.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Uy3Um79.exe]- [targetUID: 00000000-00004064] "RD5bv98.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\RD5bv98.exe]- [targetUID: 00000000-00004064] "5ua1xu7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5ua1xu7.exe]- [targetUID: 00000000-00006820] "KA9Gi99.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\KA9Gi99.exe]- [targetUID: 00000000-00007472] "urlref_httpswww.youtube.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "4oS510Xi.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4oS510Xi.exe]- [targetUID: 00000000-00007472] "1qr25WJ5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1qr25WJ5.exe]- [targetUID: 00000000-00007436] "jX4dM01.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\jX4dM01.exe]- [targetUID: 00000000-00007472] "urlref_httpsaccounts.google.com" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "nB4kp89.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\nB4kp89.exe]- [targetUID: 00000000-00003904] "2oG9025.exe" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2oG9025.exe]- [targetUID: 00000000-00006932] "6gm5zN1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6gm5zN1.exe]- [targetUID: 00000000-00004064] "3Uv90uk.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\3Uv90uk.exe]- [targetUID: 00000000-00003904] "7JT6bB79.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\IXP000.TMP\7JT6bB79.exe]- [targetUID: 00000000-00005796] "AppLaunch.exe.log" has type "CSV text"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log]- [targetUID: 00000000-00006524] "93D7.bat" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\93D5.tmp\93D6.tmp\93D7.bat]- [targetUID: 00000000-00003788] "urlref_httpswww.facebook.comlogin" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "50050455-9acb-4834-b0f4-647c4d194e7a.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "ceb6e253-00bb-454b-9b8e-b497ff4ebc42.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "5a2912bb-869b-44f9-b726-502e566e3049.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\5a2912bb-869b-44f9-b726-502e566e3049.tmp]- [targetUID: 00000000-00000764] "settings.dat" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Crashpad\settings.dat]- [targetUID: 00000000-00000764] "Variations" has type "JSON data"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\Variations]- [targetUID: 00000000-00000764] "random_1698008296.txt" has type "ASCII text with no line terminators"- Location: [%APPDATA%\random_1698008296.txt]- [targetUID: 00000000-00006932] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00001524] "eba4db5c-3f65-4a9f-8fd3-5892f750b9c5.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "a30a9ca9-187b-459f-8ae2-e3430eadc836.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- [targetUID: N/A] "91585526-d5ed-4980-84ed-173ff3fdbb79.tmp" has type "UTF-8 Unicode text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Microsoft\Edge\User Data\91585526-d5ed-4980-84ed-173ff3fdbb79.tmp]- [targetUID: 00000000-00000764]4a:T516,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "")4b:T993,"file.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Uy3Um79.exe" (UID: 5796) "Uy3Um79.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\RD5bv98.exe" (UID: 4064) "Uy3Um79.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6gm5zN1.exe" (UID: 4064) "RD5bv98.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\KA9Gi99.exe" (UID: 3780) "RD5bv98.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5ua1xu7.exe" (UID: 3780) "KA9Gi99.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\jX4dM01.exe" (UID: 7472) "KA9Gi99.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\4oS510Xi.exe" (UID: 7472) "jX4dM01.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\nB4kp89.exe" (UID: 3904) "jX4dM01.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\3Uv90uk.exe" (UID: 3904) "nB4kp89.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\1qr25WJ5.exe" (UID: 7444) "nB4kp89.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2oG9025.exe" (UID: 7444) "1qr25WJ5.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 7436) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 6524) "AppLaunch.exe" queries basic process information of the "C:\Windows\System32\winlogon.exe" (UID: 6524) "AppLaunch.exe" queries basic process information of the "C:\Windows\servicing\TrustedInstaller.exe" (UID: 6524) "2oG9025.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP\2oG9025.exe" (UID: 6932) "4oS510Xi.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 7500) "5ua1xu7.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 6820) "AppLaunch.exe" queries basic process information of the "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" (UID: 6596)4c:Ta29,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "FILE.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "")4d:T4e8,"3Uv90uk.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "3Uv90uk.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "3Uv90uk.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "3Uv90uk.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "3Uv90uk.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "3Uv90uk.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "6gm5zN1.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "6gm5zN1.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "cmd.exe" touched file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "cmd.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"4e:Tb71,"file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\CABINET.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\VERSION.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FLTLIB.DLL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\UY3UM79.EXE" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\Uy3Um79.exe" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7JT6BB79.EXE" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\7JT6bB79.exe" "Uy3Um79.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "Uy3Um79.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\CABINET.DLL" "Uy3Um79.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\VERSION.DLL" "Uy3Um79.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\FLTLIB.DLL" "Uy3Um79.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\RD5BV98.EXE" "Uy3Um79.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\RD5bv98.exe" "Uy3Um79.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6GM5ZN1.EXE" "Uy3Um79.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\6gm5zN1.exe" "RD5bv98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL" "RD5bv98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\CABINET.DLL" "RD5bv98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\VERSION.DLL" "RD5bv98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\FLTLIB.DLL" "RD5bv98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\KA9GI99.EXE" "RD5bv98.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\KA9Gi99.exe" "RD5bv98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5UA1XU7.EXE" "RD5bv98.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\5ua1xu7.exe" "KA9Gi99.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\System32\WOW64LOG.DLL"4f:T8a6,"file.exe" trying to access non-existent file "\Device\HarddiskVolume2\FILE.EXE.LOCAL" "file.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "Uy3Um79.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\UY3UM79.EXE.LOCAL" "Uy3Um79.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "Uy3Um79.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "RD5bv98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\RD5BV98.EXE.LOCAL" "RD5bv98.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "RD5bv98.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" "KA9Gi99.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\KA9GI99.EXE.LOCAL" "KA9Gi99.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "KA9Gi99.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" "jX4dM01.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\JX4DM01.EXE.LOCAL" "jX4dM01.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "jX4dM01.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP" "nB4kp89.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP004.TMP\NB4KP89.EXE.LOCAL" "nB4kp89.exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" "nB4kp89.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP005.TMP" "AppLaunch.exe" trying to access non-existent file "\Device\HarddiskVolume2\Windows\SysWOW64\MSCOREE.DLL.LOCAL"50:T1046,Pattern match: "https://www.youtube.com/" Pattern match: "https://www.facebook.com/login" Pattern match: "https://accounts.google.com/" Heuristic match: "=Y.al" Heuristic match: ",;.NF" Heuristic match: "/2.Im" Pattern match: "https://www.facebook.com/loginstart" Pattern match: "www.youtube.com\//g" Pattern match: "https://www.youtube.com/error_204?t=jserror&level=ERROR" Pattern match: "https://www.youtube.com/s/desktop/b926992e/img/favicon.ico" Pattern match: "https://i.ytimg.com/generate_204" Pattern match: "https://www.youtube.com/s/desktop/b926992e/jsbin/scheduler.vflset/scheduler.js" Pattern match: "https://www.youtube.com/s/desktop/b926992e/jsbin/network.vflset/network.js" Pattern match: "https://www.youtube.com/s/desktop/b926992e/cssbin/www-main-desktop-watch-page-skeleton.css" Pattern match: "https://www.youtube.com" Pattern match: "https://accounts.google.com" Pattern match: "https://www.facebook.com/login/" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/y_/l/0,cross/piXcg3ZJdR_.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yy/l/0,cross/AGsXeX2D0Rm.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yg/l/0,cross/38vyyaAjg10.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yQ/r/bnRvNSHX7Ev.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "www.kfc.co.th,learn.pantheon.io,www.landmarkshops.in,www.ncl.com,s0.wp.com,www.tatacliq.com,bs.serving-sys.com,kohls.com,lazada.co.th,xg4ken.com,technopark.ru,officedepot.com.mx,bestbuy.com.mx,booking.com,nibio.no,myworkdayjob" Pattern match: "www.facebook.com\/login}]],[UITinyViewportAction,init,[],[]],[ResetScrollOnUnload,init,[__elem_a588f507_0_0_ur],[{__m:__elem_a588f507_0_0_ur}]],[KeyboardActivityLogger,init,[],[]],[FocusRing,init,[],[]],[ErrorMessageConsole,listen" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yl/l/0,cross/R2oOyt8zLzV.css?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yh/r/bpW4eEg-2_W.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3i7M54/ya/l/en_US/kzikDtJjAjw.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/BQn1Lzzcmjv.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yG/r/rAl2Hl1fQTa.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://static.xx.fbcdn.net/rsrc.php/v3/yM/r/SeW64FDUgJN.js?_nc_x=Ij3Wp8lg5Kz" Pattern match: "https://pixel.facebook.com},325],[WebStorageMonsterLoggingURI,[],{uri:/ajax/webstorage/process_keys/?state=1},3032],[BrowserPaymentHandlerConfig,[],{enabled:false},3904],[TimeSpentConfig,[],{delay:1000,timeout:64,0_delay:0,0_timeout:8},142],[" Pattern match: "https://accounts.google.com/v3/signin/" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/ss/k=boq-identity.AccountsSignInUi.8dPAf41KP2A.L.B1.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/ed=1/rs=AOaEmlFu7so_cG35thTT-KKqKIyGIgUn8w/m=identifierview,_b,_tp" Pattern match: "fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVGdeOYktMqlap.woff2" Pattern match: "https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.C6tNd3FBrA8.es5.O/am=DmBFZI4NgOD_oonn7xknhwEAAAAAAAAAANZAdg/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHK_6NZi0yeSin1ommAktmAN0EneA/m=_b,_tp" Pattern match: "fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1MmgVxFIzIXKMnyrYk.woff2" Pattern match: "https://accounts.google.com/AccountChooser?continue\u003dhttps://accounts.google.com/\u0026followup\u003dhttps://accounts.google.com/],[null,[null,null,https://accounts.google.com/Logout?continue\u003dhttps://accounts.google.com/restart?continue%3Dhttps:" Pattern match: "www.playstation.com},{applied_policy:block,domain:bing.com},{applied_policy:block,domain:browserbench.org},{applied_policy:block,domain:www.principledtechnologies.com},{applied_policy:block,domain:web.basemark.com},{applie" Pattern match: "http://193.233.255.73/loghub/master" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Heuristic match: ".WSF;.WS" Pattern match: "http://193.233.255.73/" Heuristic match: "KTa.Lr"51:T71d,"file.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00005796) "file.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00005796) "RD5bv98.exe" called "FindFirstFileA" with parameter %TEMP%\IXP002.TMP\* (UID: 00000000-00003780) "RD5bv98.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003780) "KA9Gi99.exe" called "FindFirstFileA" with parameter %TEMP%\IXP003.TMP\* (UID: 00000000-00007472) "KA9Gi99.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007472) "jX4dM01.exe" called "FindFirstFileA" with parameter %TEMP%\IXP004.TMP\* (UID: 00000000-00003904) "jX4dM01.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003904) "nB4kp89.exe" called "FindFirstFileA" with parameter %TEMP%\IXP005.TMP\* (UID: 00000000-00007444) "nB4kp89.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00007444) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006524) "AppLaunch.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006524) "AppLaunch.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006524) "AppLaunch.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006524) "AppLaunch.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006524) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006524) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006524) "AppLaunch.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006524) "AppLaunch.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006524)52:T6f5,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "file.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "file.exe") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")53:T682,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "file.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "file.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "3Uv90uk.exe.3013844059") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "3Uv90uk.exe.3013844059") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003640.00000000.67300.002B4000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")54:T5cf,Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; File: "file.exe") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; File: "file.exe") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; File: "file.exe") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "RegOpenKeyExA" (Indicator: "RegOpenKey"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "RegQueryInfoKeyA" (Indicator: "RegQueryInfoKey"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")55:T796,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "file.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "file.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "file.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "file.exe") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "file.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "file.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "file.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "file.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")56:T4de,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "file.exe") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "file.exe") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")57:T425,Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; File: "file.exe") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "RegDeleteValueA" (Indicator: "RegDeleteValue"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")58:T4d9,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "file.exe") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "file.exe") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "file.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "file.exe") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; File: "file.exe") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003780.00000000.66756.00211000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003780.00000000.66756.00211000.00000020.mdmp") file/memory contains long string with (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")59:T449,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "file.exe") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")5a:T7c1,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "file.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "file.exe") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "file.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "file.exe") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00003640.00000000.67300.02C70000.00000004.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00003780.00000000.66756.02980000.00000004.mdmp, 00000000-00003780.00000001.68676.02980000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00003780.00000001.68676.0021A000.00000002.mdmp")5b:T1664,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: file.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: file.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: file.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: file.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: file.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: Uy3Um79.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: Uy3Um79.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Uy3Um79.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: Uy3Um79.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: Uy3Um79.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: RD5bv98.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: RD5bv98.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: RD5bv98.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: RD5bv98.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: RD5bv98.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: KA9Gi99.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: KA9Gi99.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: KA9Gi99.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: KA9Gi99.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: KA9Gi99.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: jX4dM01.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: jX4dM01.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: jX4dM01.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: jX4dM01.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: jX4dM01.exe] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: nB4kp89.exe] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: nB4kp89.exe] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: nB4kp89.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: nB4kp89.exe] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: nB4kp89.exe] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: 2oG9025.exe] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: 2oG9025.exe] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: 2oG9025.exe] Observed import api "ImpersonateLoggedOnUser" which can "Lets the calling thread impersonate the security context of a logged-on user" [Source: 2oG9025.exe] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: 2oG9025.exe] Observed import api "RevertToSelf" which can "Terminates the impersonation of a client application" [Source: 2oG9025.exe] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: 2oG9025.exe] Observed import api "GetSidIdentifierAuthority" which can "Returns a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: 6gm5zN1.exe] Observed import api "GetSidSubAuthority" which can "Returns a pointer to a specified subauthority in a security identifier (SID)" [Source: 6gm5zN1.exe] Observed import api "GetSidSubAuthorityCount" which can "Returns a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 6gm5zN1.exe]5c:T10f2,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP000.TMP\UY3UM79.EXE"; Value: "") "Uy3Um79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\RD5BV98.EXE"; Value: "") "Uy3Um79.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP001.TMP\6GM5ZN1.EXE"; Value: "") "RD5bv98.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\KA9GI99.EXE"; Value: "") "RD5bv98.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP002.TMP\5UA1XU7.EXE"; Value: "") "KA9Gi99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\JX4DM01.EXE"; Value: "") "KA9Gi99.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP003.TMP\4OS510XI.EXE"; Value: "") "jX4dM01.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\NB4KP89.EXE"; Value: "") "jX4dM01.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP004.TMP\3UV90UK.EXE"; Value: "") "nB4kp89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP005.TMP\1QR25WJ5.EXE"; Value: "") "nB4kp89.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IXP005.TMP\2OG9025.EXE"; Value: "") "1qr25WJ5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\APPLAUNCH.EXE"; Value: "") "2oG9025.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "3Uv90uk.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "3Uv90uk.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "3Uv90uk.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "3Uv90uk.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "3Uv90uk.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "3Uv90uk.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "3Uv90uk.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "")5d:T7b3,"Uy3Um79.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP000.TMP\Uy3Um79.exe]- [targetUID: 00000000-00004064] "RD5bv98.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\RD5bv98.exe]- [targetUID: 00000000-00004064] "5ua1xu7.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\5ua1xu7.exe]- [targetUID: 00000000-00006820] "KA9Gi99.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP002.TMP\KA9Gi99.exe]- [targetUID: 00000000-00007472] "4oS510Xi.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\4oS510Xi.exe]- [targetUID: 00000000-00007472] "1qr25WJ5.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP005.TMP\1qr25WJ5.exe]- [targetUID: 00000000-00007436] "jX4dM01.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP003.TMP\jX4dM01.exe]- [targetUID: 00000000-00007472] "nB4kp89.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\nB4kp89.exe]- [targetUID: 00000000-00003904] "2oG9025.exe" has type "PE32+ executable (console) x86-64 for MS Windows"- Location: [%TEMP%\IXP005.TMP\2oG9025.exe]- [targetUID: 00000000-00006932] "6gm5zN1.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP001.TMP\6gm5zN1.exe]- [targetUID: 00000000-00004064] "3Uv90uk.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\IXP004.TMP\3Uv90uk.exe]- [targetUID: 00000000-00003904] "7JT6bB79.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"- Location: [%TEMP%\IXP000.TMP\7JT6bB79.exe]- [targetUID: 00000000-00005796] "explothe.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\fefffe8cea\explothe.exe]- [targetUID: 00000000-00001524]5e:T719,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Uy3Um79.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "RD5bv98.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "KA9Gi99.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "jX4dM01.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "nB4kp89.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "1qr25WJ5.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "AppLaunch.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "3Uv90uk.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "4oS510Xi.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "5ua1xu7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "6gm5zN1.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "explothe.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cacls.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")5f:T4001,"initAft()