26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T431,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 770c55cdd8a7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 770c55cdd8a7…. Threat score 100/100. 0/26 AV engines flagged this file. 14 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d"],"about":{"@type":"SoftwareApplication","name":"spybotsd-2.7.64.0-1.exe","applicationCategory":["peexe","executable"],"identifier":"770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":14,"suspicious":31},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T45b,Found string "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp")28:T724,Found string "OpenServiceA" (Indicator: "OpenService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "ControlService" (Indicator: "ControlService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "ControlService@WaitForService:" (Indicator: "ControlService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenService@SimpleStopService:" (Indicator: "OpenService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "ControlService@SimpleStopService:" (Indicator: "ControlService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenService@SilentStopService:" (Indicator: "OpenService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "ControlService@SilentStopService:" (Indicator: "ControlService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenService@SimpleStartService:" (Indicator: "OpenService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenService@SimpleDeleteService:" (Indicator: "OpenService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "SimpleSetServiceStartup@OpenService:" (Indicator: "OpenService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenService@ServiceExists:" (Indicator: "OpenService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenService@SimpleQueryService:" (Indicator: "OpenService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "ControlService@SimpleQueryService:" (Indicator: "ControlService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp")29:T781,"spybotsd-2.7.64.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000bf0000005c77100ace756241f072e0f7bf00ffffffffffffffff2200000000000000e0f7bf000000000000000000000000000000000000000000220000c0000000000100000000000000ffffffffffffffff2e7ba5e100005c77100ace75e99cea7704000000a0f7bf00220000c010f8bf00506aec77527ba5e1feffffffe8f7bf00e3e2c47505000000100ace7571f2c37509000000a855db1b04f8bf00043c5d7700000000fcf7bf000800000001000000200000005c3a40002cf8bf006b3a400024f8bf00b0f3de043c6b4000016f4000b0f3de045cf8bf000a99400050f8bf000d3a40001f0000007c154100b4aa40000e2e4000216140000e000000 (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c23761cf2bf00226e5b7500004003000000002d6e5b75300aecdc2d000000ecb71976a0f2bf00b1ce98009853657660f2bf00b1ce980080000000e0f1bf000100000064f2bf0070c85c75d48932a9feffffff2d000000d0cc28762700000034f2bf00856a5d751c23627574f2bf00f85f5d7508000000bb695c75b2695c75580aecdc2d000000ecb7197627000000d0cc287648f2bf002d000000d0cc28762700000078f2bf00856a5d751c236275c0f2bf007e8a2776ee8c2776738a2776ebaab00b2d000000ecb7197627000000d0cc2876b411400348114003ebaab00b88f2bf00fc52657674f3bf00e084277613a96c7dfeffffff738a2776 (UID: 00000000-00007856)2a:T4e0,Found string "GetKeyboardType" (Indicator: "GetKeyboardType"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "GetKeyboardType" (Indicator: "GetKeyboardType"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetUserDefaultLangID" (Indicator: "GetUserDefaultLangID"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp")2b:T843,Found string "GetVersion" (Indicator: "GetVersion"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "GetVersionExW" (Indicator: "GetVersionExW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "GetVersionExW" (Indicator: "GetVersion"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "ISCryptGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "function GetVersionNumbers(const Filename: String; var VersionMS, VersionLS: Cardinal): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "function GetVersionNumbersString(const Filename: String; var Version: String): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "DllGetVersion" (Indicator: "GetVersion"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp")2c:T580,"spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007856) "spybotsd-2.7.64.0.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007856)2d:T10ee3,Found reference to API (Indicator: "GetLongPathNameW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "SetProcessDEPPolicy"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "SysFreeString"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "SysReAllocStringLen"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "SysAllocStringLen"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "RegQueryValueExW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "RegOpenKeyExW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "RegCloseKey"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetKeyboardType"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "LoadStringW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "MessageBoxA"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "CharNextW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetACP"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "Sleep"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "VirtualFree"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetTickCount"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetVersion"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "VirtualQuery"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "lstrlenW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "lstrcpynW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetThreadLocale"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetStartupInfoA"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetProcAddress"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetLocaleInfoW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "FreeLibrary"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "FindFirstFileW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "FindClose"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "ExitProcess"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "WriteFile"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "RtlUnwind"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "RaiseException"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetStdHandle"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "CloseHandle"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "TlsSetValue"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "TlsGetValue"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "LocalAlloc"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "CreateWindowExW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "TranslateMessage"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "PeekMessageW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "MessageBoxW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "ExitWindowsEx"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "DispatchMessageW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "DestroyWindow"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "CharUpperBuffW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "VirtualProtect"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "SizeofResource"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "SetLastError"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "SetFilePointer"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "SetEvent"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "SetErrorMode"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "ResetEvent"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "RemoveDirectoryW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "ReadFile"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "LockResource"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "LoadResource"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetVersionExW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetLastError"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetFullPathNameW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetFileSize"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetCPInfo"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "FormatMessageW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "FindResourceW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "EnumCalendarInfoW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "DeleteFileW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "CreateProcessW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "CreateFileW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "CreateEventW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "CreateDirectoryW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00007856.00000000.78698.00401000.00000020.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00007856.00000000.78698.00401000.00000020.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00007856.00000000.78698.00401000.00000020.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; Source: "00000000-00007856.00000000.78698.00401000.00000020.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00007856.00000000.78698.00401000.00000020.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; Source: "00000000-00007856.00000000.78698.00401000.00000020.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SysReAllocStringLen"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SysAllocStringLen"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardType"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "lstrcpynW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CharUpperBuffW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EnumCalendarInfoW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "OpenSCManagerA"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found reference to API (Indicator: "OpenServiceA"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found reference to API (Indicator: "StartServiceA"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found reference to API (Indicator: "ControlService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found reference to API (Indicator: "CreateServiceA"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found reference to API (Indicator: "DeleteService"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found reference to API (Indicator: "ChangeServiceConfigA"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExA"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "AnimateWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MoveFile"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MoveFileEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateNamedPipe"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateFile"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "sendto"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WaitMessage"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "TranslateMDISysAccel"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ShowScrollBar"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPlacement"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetScrollPos"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetScrollInfo"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ScrollWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RemoveMenu"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "OemToCharBuffA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IsRectEmpty"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IsDialogMessageA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IntersectRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "InsertMenuItemW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "InsertMenuW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetScrollRange"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetScrollPos"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetMenuState"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetKeyNameTextW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetIconInfo"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetDCEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetCursor"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EndPaint"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EnableScrollBar"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DrawIcon"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DrawFrameControl"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DrawEdge"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DestroyCursor"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DeleteMenu"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateIcon"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CheckMenuItem"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "BringWindowToTop"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "AppendMenuW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CharToOemBuffA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ActivateKeyboardLayout"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetStretchBltMode"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RoundRect"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WNetOpenEnumW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WNetGetUniversalNameW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WNetEnumResourceW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WNetCloseEnum"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetThreadLocale"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "OpenMutexW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IsBadWritePtr"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GlobalFindAtomW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GlobalDeleteAtom"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GlobalAddAtomW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateNamedPipeW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegFlushKey"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetActiveObject"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "StringFromCLSID"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "IsEqualGUID"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayPtrOfIndex"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayPutElement"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayGetElement"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayGetUBound"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayGetLBound"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SafeArrayCreate"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VariantChangeType"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VariantCopyInd"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VariantCopy"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VariantClear"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "VariantInit"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ExtractIconW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SHGetMalloc"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CoDisconnectObject"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "StrToInt64ExW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EnumResourceLanguagesW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "EnumResourceNamesW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "AddAccessAllowedAce"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp")2e:T5f3,Found string "SizeofResource" (Indicator: "SizeofResource"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "LockResource" (Indicator: "LockResource"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "LoadResource" (Indicator: "LoadResource"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "FindResourceW" (Indicator: "FindResource"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "LockResource" (Indicator: "LockResource"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp")2f:T50d,Found string "OpenSCManagerA" (Indicator: "OpenSCManager"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenSCManager@SimpleCreateService:" (Indicator: "OpenSCManager"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenSCManager@SimpleStopService:" (Indicator: "OpenSCManager"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenSCManager@SilentStopService:" (Indicator: "OpenSCManager"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenSCManager@SimpleStartService:" (Indicator: "OpenSCManager"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenSCManager@SimpleDeleteService:" (Indicator: "OpenSCManager"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "SimpleSetServiceStartup@OpenSCManager:" (Indicator: "OpenSCManager"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenSCManager@ServiceExists:" (Indicator: "OpenSCManager"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp") Found string "OpenSCManager@SimpleQueryService:" (Indicator: "OpenSCManager"; Source: "00000000-00007856.00000000.78698.04CF0000.00000004.mdmp")30:T1008,"spybotsd-2.7.64.0.exe" loaded module "C:\spybotsd-2.7.64.0.exe" at 00400000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\System32\ntdll.dll" at FD200000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77E50000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\System32\wow64.dll" at 52F00000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\System32\wow64win.dll" at 52F70000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\System32\user32.dll" at 02E60000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 52F60000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 775C0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 75B60000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 75FF0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 774D0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 74AC0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 75D40000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 751F0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 74870000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 74860000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74920000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 75520000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 754A0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 75570000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 752D0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 77BB0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 749A0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 759B0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" at 73720000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 74BE0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 72EF0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 77550000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 74610000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 72E70000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 77D50000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\shell32.dll" at 76170000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\cfgmgr32.dll" at 77B20000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\SHCore.dll" at 74A30000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\windows.storage.dll" at 74C10000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\shlwapi.dll" at 75B10000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\kernel.appcore.dll" at 74990000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\powrprof.dll" at 75450000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\profapi.dll" at 752B0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\uxtheme.dll" at 740E0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\msctf.dll" at 75850000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\dwmapi.dll" at 736F0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\TextInputFramework.dll" at 73670000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\CoreUIComponents.dll" at 733A0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\CoreMessaging.dll" at 735E0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\ntmarta.dll" at 73A60000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\WinTypes.dll" at 732D0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SysWOW64\clbcatq.dll" at 7489000031:T544,"spybotsd-2.7.64.0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75b60000 "spybotsd-2.7.64.0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75b60000 "spybotsd-2.7.64.0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75b60000 "spybotsd-2.7.64.0.exe" loaded module "KERNEL32" at base 775c0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72e70000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 76170000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 740e0000 "spybotsd-2.7.64.0.exe" loaded module "COMCTL32.DLL" at base 73720000 "spybotsd-2.7.64.0.exe" loaded module "KERNEL32.DLL" at base 775c0000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75850000 "spybotsd-2.7.64.0.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77d50000 "spybotsd-2.7.64.0.exe" loaded module "OLEAUT32.DLL" at base 75ff0000 "spybotsd-2.7.64.0.exe" loaded module "RPCRT4.DLL" at base 751f0000 "spybotsd-2.7.64.0.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 752d0000 "spybotsd-2.7.64.0.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 752d0000 "spybotsd-2.7.64.0.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 75d4000032:Tad7,Heuristic match: "1HI_P.GE" Pattern match: "http://schemas.microsoft.com/SMI/2" Heuristic match: "*j.nE" Heuristic match: ":L^.vC" Heuristic match: "g$yC.Ir" Heuristic match: "Mj.cR" Heuristic match: ")Tz.cM" Heuristic match: "aq.jP" Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "at@.at" Heuristic match: "LKEYLOGFILE=C:\Users\HAPUBWS\AppData\Local\Temp\sslkey.th" Pattern match: "http://www.kymoto.org" Pattern match: "http://www.palkornel.hu/innosetup" Pattern match: "http://www.dk-soft.org/" Pattern match: "http://www.safer-networking.org/" Pattern match: "http://www.safer-networking.org/dl/" Pattern match: "http://www.safer-networking.org/contact/" Pattern match: "http://www.safer-networking.org.\par" Pattern match: "http://www.safer-networking.org/spybot2allocator.php?current_version" Pattern match: "http://www.safer-networking.org/shop/" Pattern match: "http://www.safer-networking.org/dl/donate/" Pattern match: "http://www.safer-networking.org/business/" Pattern match: "http://www.safer-networking.org/business/technician-edition/" Heuristic match: ".K.RE" Heuristic match: ",d.SN" Heuristic match: "COMMAND.COM" Pattern match: "http://www.innosetup.com/" Pattern match: "http://www.remobjects.com/ps" Heuristic match: "Font.Name" Pattern match: "www.digicert.com1+0" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0" Pattern match: "crl3.digicert.com/EVCodeSigningSHA2-g1.crl07" Pattern match: "crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0H" Pattern match: "http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0" Pattern match: "http://ocsp.digicert.com0I" Pattern match: "http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0" Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0" Pattern match: "http://www.safer-networking.org/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDCA-1.crl08" Pattern match: "crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0"33:T44b,Found string "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetDC" (Indicator: "GetDC"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetDCOrgEx" (Indicator: "GetDC"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp")34:T54c,Found string "RegQueryValueExW" (Indicator: "RegQueryValue"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "RegOpenKeyExW" (Indicator: "RegOpenKey"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "RegOpenKeyEx" (Indicator: "RegOpenKey"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;" (Indicator: "RegGetValue"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "RegOpenKeyA" (Indicator: "RegOpenKey"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp")35:T5d1,Found string "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "GetFileSize" (Indicator: "GetFileSize"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp")36:T4ba,"SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007856.00000000.78698.04CF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007856.00000000.78698.04CF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007856.00000000.78698.04CF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007856.00000000.78698.7F580000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007856.00000000.78698.7F580000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00007856.00000000.78698.7F580000.00000004.mdmp37:T521,Found string "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "DeleteFileW" (Indicator: "DeleteFile"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "DeleteFile" (Indicator: "DeleteFile"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);" (Indicator: "DeleteFile"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "function DeleteFile(const FileName: string): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp")38:T4a0,Found string "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.bin") Found string "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00007856.00000000.78698.00401000.00000020.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007856.00000000.78698.00412000.00000004.mdmp, 00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp")39:T63c,Found string "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "GetAce" (Indicator: "GetAce"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp") Found string "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00007856.00000000.78698.7F580000.00000004.mdmp")3a:T417,Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: spybotsd-2.7.64.0.tmp] Observed import api "EqualSid" which can "Tests two security identifier (SID) values for equality" [Source: spybotsd-2.7.64.0.tmp] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: spybotsd-2.7.64.0.tmp] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: spybotsd-2.7.64.0.tmp] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: spybotsd-2.7.64.0.tmp] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: spybotsd-2.7.64.0.tmp] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: spybotsd-2.7.64.0.tmp]3b:Td6c,"spybotsd-2.7.64.0.exe" wrote bytes "7058a67540c5a8754082a675009aa9758078a3750073a375d014a675707da375002da5756076a3752077a675c07ca375904fa3751066a6751036a675a07ea67570a2a3753036a375" to virtual address "0x749BE0D8" (part of module "GDI32.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "d0e4a675c0e4a675a0dca67520b1a67590afa675f056a675e086aa7520c7a67540eca67520eea675" to virtual address "0x749BE958" (part of module "GDI32.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "d05fa375007ea375905ca6754098a675e0a1a3752068a675d0d5a375104ea3757034a3753071a3750031a6758074a6754012a6752042a675e0afa675" to virtual address "0x749BE098" (part of module "GDI32.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "1076a675a05fa67530d5a375f056a375a0e7a875e07ba375b0d6a875b024a4751045a675204da67590e5a875" to virtual address "0x749BE19C" (part of module "GDI32.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "0041e375003de375608adb75b0ffdd750091db75b007e175e0b6dd7550b6dd75b0f0dc750092e37550bcdd75b0ffe0759041e37570b7dd7510c7e3758004dd75" to virtual address "0x74909058" (part of module "CLBCATQ.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "0089a675" to virtual address "0x749BE010" (part of module "GDI32.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "600b8975" to virtual address "0x736E003C" (part of module "TEXTINPUTFRAMEWORK.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "b0845f73a0aa617350855f7380875f73f0865f73" to virtual address "0x75944000" (part of module "MSCTF.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "1036997420369974" to virtual address "0x75F501A0" (part of module "COMBASE.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "5065a97510eda5758072a67570c6a875" to virtual address "0x749BE04C" (part of module "GDI32.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "e03aa675e002a675f03da675" to virtual address "0x749BE000" (part of module "GDI32.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "40b6e37580dee375" to virtual address "0x74BFD0E4" (part of module "IMM32.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "10f22e7500b92d75f091ed77109d2e7590922e75c0b42e7550882e75d0672e7540b22e75209c2e75108c2e75a0a42e75507c2e7550a92e75c0b32e75805d2e75c0e62e7590752e75c0ee2e75a0c42e7500c02e7510d22d7560aa2e75" to virtual address "0x75F50228" (part of module "COMBASE.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "10a30076e0a7007680a00076f08a017660690076f057007620a90076008b017670a80076" to virtual address "0x75F50014" (part of module "COMBASE.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "801fa575a05aa675e094a675d07ba675b01ea575d01da575f0e3a875703fa67550faa375a080a475" to virtual address "0x749BE138" (part of module "GDI32.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "d04ff075f0c2da7590c6e37500cbda75f0f3e27540dde27560efe275102ddb7580a6da7520bee1757042e375a0bee175c0ffda7540bfe175e058e375" to virtual address "0x751715B0" (part of module "WINDOWS.STORAGE.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "d04c6f7370646f73f0406f73003f6f73205d6f73606b6f73f0287073c03c6f73" to virtual address "0x74152078" (part of module "UXTHEME.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "40d25275300d5375c0cd5275" to virtual address "0x75F50058" (part of module "COMBASE.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "00f0d777104cd87760f4d977603dd877b046d877d06bd877b044d877604bd87700fcdd77806dda77b0a0db77305fde77d09adb77a048d777" to virtual address "0x75F500D8" (part of module "COMBASE.DLL") "spybotsd-2.7.64.0.exe" wrote bytes "1006ea77" to virtual address "0x736E0000" (part of module "TEXTINPUTFRAMEWORK.DLL")3c:T4bf,GetVersion@KERNEL32.DLL at 00022264-00003820-40610-154-0040646C GetVersionExW@KERNEL32.DLL at 00022264-00003820-40610-147-0040A358 GetVersion@KERNEL32.DLL at 00022264-00003820-40610-537-004110C4 GetVersion@KERNEL32.DLL at 00022264-00003820-40610-153-00411000 GetVersion@KERNEL32.DLL at 00022417-00003392-57267-1091-0047FFEC GetVersion@KERNEL32.DLL at 00022417-00003392-57267-1319-004CC238 GetVersion@KERNEL32.DLL at 00022417-00003392-57267-1442-004B8A78 GetVersionExW@KERNEL32.DLL at 00022417-00003392-57267-1213-004124AC GetVersion@KERNEL32.DLL at 00022417-00003392-57267-1218-00408DE4 GetVersion@KERNEL32.DLL at 00022417-00003392-57267-1217-00500000 GetVersionExW@KERNEL32.DLL at 00029849-00002712-63708-314-00F324C0 GetVersionExW@KERNEL32.DLL at 00029849-00002712-63708-434-00F32C20 GetVersionExW@KERNEL32.DLL at 00030671-00003780-18808-314-000524C0 GetVersionExW@KERNEL32.DLL at 00030671-00003780-18808-434-00052C20 GetVersion@kernel32.dll at 4084-1254-00402790 GetVersion@kernel32.dll at 4084-1458-0040CC84 GetVersion@kernel32.dll at 4084-1452-00515884 GetVersion@kernel32.dll at 4084-1253-0040B1A4 GetVersion@kernel32.dll at 4084-1261-00409814 GetVersion@kernel32.dll at 65428-1072-004027343d:T6e6,Found API call GetVersion@KERNEL32.DLL directly followed by "cmp edx, 05h" and "jne 0040648Bh" at 00022264-00003820-40610-154-0040646C Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000600h" and "je 0041112Bh" at 00022264-00003820-40610-537-004110C4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 0048006Bh" at 00022417-00003392-57267-1091-0047FFEC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 004CC2A7h" at 00022417-00003392-57267-1319-004CC238 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 004B8AAFh" at 00022417-00003392-57267-1442-004B8A78 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp edx, 05h" and "jne 00408E03h" at 00022417-00003392-57267-1218-00408DE4 Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-0000011Ch], 06h" and "inc eax" at 00029849-00002712-63708-314-00F324C0 Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp dword ptr [ebp-0000011Ch], 06h" and "inc eax" at 00030671-00003780-18808-314-000524C0 Found API call GetVersion@kernel32.dll directly followed by "cmp eax, 80000000h" and "je 0051597Fh" at 4084-1452-00515884 Found API call GetVersion@kernel32.dll directly followed by "cmp edx, 05h" and "jne 0040B1C3h" at 4084-1253-0040B1A4 Found API call GetVersion@kernel32.dll directly followed by "cmp byte ptr [0053DB54h], 00h" and "je 00409892h" at 4084-1261-00409814 Found API call GetVersion@kernel32.dll directly followed by "cmp edx, 05h" and "jne 0040AF5Fh" at 65428-1071-0040AF40 Found API call GetVersion@kernel32.dll directly followed by "cmp byte ptr [00564B54h], 00h" and "je 0040968Eh" at 65428-1079-004096103e:Ta39,"spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-258949708622 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\Program Files\Spybot - Search & Destroy 2\unins000.exe" at 00022417-00003392-0000010C-258984910941 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-259486844455 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe" at 00022417-00003392-0000010C-259488197035 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-259632415213 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe" at 00022417-00003392-0000010C-259633644813 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-259800764010 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe" at 00022417-00003392-0000010C-259801910812 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-259870947513 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe" at 00022417-00003392-0000010C-259872575201 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-259993762070 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" at 00022417-00003392-0000010C-259995692236 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-260637523674 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\Program Files\Spybot - Search & Destroy 2\SDFiles.exe" at 00022417-00003392-0000010C-260639708535 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-260777271848 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe" at 00022417-00003392-0000010C-260780981600 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-261676152673 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe" at 00022417-00003392-0000010C-261677603525 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-261773938951 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe" at 00022417-00003392-0000010C-2617765363593f:T6b9,"spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-258949708622 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-259486844455 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-259632415213 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-259800764010 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-259870947513 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-259993762070 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-260637523674 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-260777271848 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-261676152673 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-261773938951 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-262404546082 "spybotsd-2.7.64.0.tmp" queries volume information of "C:\" at 00022417-00003392-0000010C-262721434896 "SDTray.exe" queries volume information of "C:\" at 00029845-00003004-0000010C-271854126990 "SDWelcome.exe" queries volume information of "C:\" at 00031928-00000320-0000010C-347757379149 "SDUpdate.exe" queries volume information of "C:\" at 00031944-00002164-0000010C-351517294392 "SDWelcome.exe" queries volume information of "C:\" at 00031957-00002824-0000010C-349346471037 "SDUpdate.exe" queries volume information of "C:\" at 00031980-00003704-0000010C-35179761094940:T7a5,"SDFSSvc.exe" (Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")41:T68a,"SDFSSvc.exe" (Path: "HKU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "SDFSSvc.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SDFSSvc.exe" (Path: "HKU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")42:T867,"spybotsd-2.7.64.0.tmp" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "spybotsd-2.7.64.0.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TREATAS") "spybotsd-2.7.64.0.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "spybotsd-2.7.64.0.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "spybotsd-2.7.64.0.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "spybotsd-2.7.64.0.tmp" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS") "spybotsd-2.7.64.0.tmp" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "spybotsd-2.7.64.0.tmp" touched "Task Bar Communication" (Path: "HKCU\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "spybotsd-2.7.64.0.tmp" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "spybotsd-2.7.64.0.tmp" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "spybotsd-2.7.64.0.tmp" touched "All Control Panel Items" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{21EC2020-3AEA-1069-A2DD-08002B30309D}\") "spybotsd-2.7.64.0.tmp" touched "Scheduling Agent Service Class" (Path: "HKCU\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\TREATAS") "spybotsd-2.7.64.0.tmp" touched "TaskScheduler class" (Path: "HKCU\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "SDTray.exe" touched "Microsoft Windows Font Folder" (Path: "HKCU\CLSID\{BD84B380-8CA2-1069-AB1D-08000948F534}") "SDTray.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "SDTray.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "SDWSCSvc.exe" touched "Windows Security Center ISV API" (Path: "HKCU\CLSID\{F2102C37-90C3-450C-B3F6-92BE1693BDF2}")43:T5a0,"spybotsd-2.7.64.0.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "spybotsd-2.7.64.0.exe" touched file "C:\Windows\system32\en\KERNELBASE.dll.mui" "spybotsd-2.7.64.0.exe" touched file "C:\Windows\System32\netmsg.dll" "spybotsd-2.7.64.0.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "spybotsd-2.7.64.0.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\Fonts\StaticCache.dat" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\System32\en-US\user32.dll.mui" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\system32\en\KERNELBASE.dll.mui" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\System32\netmsg.dll" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\comctl32.dll.mui" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\System32\shfolder.dll" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\System32\imageres.dll" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\System32\en-US\shell32.dll.mui" "spybotsd-2.7.64.0.tmp" touched file "C:\Windows\system32\en\shell32.dll.mui"44:Tb2d,"spybotsd-2.7.64.0.tmp" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS") "spybotsd-2.7.64.0.tmp" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST") "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST"; Key: "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY 2\SDTRAY.EXE"; Value: "%PROGRAMFILES%\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon") "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST"; Key: "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY 2\SDTRAY.EXE"; Value: "%PROGRAMFILES%\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot - Search & Destroy tray access") "spybotsd-2.7.64.0.tmp" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SDSCANNERSERVICE\") "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SDSCANNERSERVICE"; Key: "DEPENDONSERVICE"; Value: "Tcpip") "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST"; Key: "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY 2\SDFSSVC.EXE"; Value: "%PROGRAMFILES%\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service") "spybotsd-2.7.64.0.tmp" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SDUPDATESERVICE\") "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SDUPDATESERVICE"; Key: "DEPENDONSERVICE"; Value: "Tcpip") "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST"; Key: "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY 2\SDUPDATE.EXE"; Value: "%PROGRAMFILES%\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater") "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST"; Key: "C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY 2\SDUPDSVC.EXE"; Value: "%PROGRAMFILES%\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service") "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SDUPDATESERVICE"; Key: "DESCRIPTION"; Value: "Downloads updates and installs them.") "spybotsd-2.7.64.0.tmp" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\SPYBOT - SEARCH AND DESTROY\")45:T478,"spybotsd-2.7.64.0.tmp" read file "C:\Windows\win.ini" "SDTray.exe" read file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "SDTray.exe" read file "C:\Windows\Fonts\desktop.ini" "SDTray.exe" read file "C:\Program Files\desktop.ini" "SDTray.exe" read file "C:\Users\desktop.ini" "SDTray.exe" read file "C:\Users\%OSUSER%\Desktop\desktop.ini" "SDTray.exe" read file "C:\Users\%OSUSER%\Favorites\desktop.ini" "SDTray.exe" read file "C:\Users\%OSUSER%\Documents\desktop.ini" "SDTray.exe" read file "C:\Users\%OSUSER%\Music\desktop.ini" "SDTray.exe" read file "C:\Users\%OSUSER%\Videos\desktop.ini" "SDTray.exe" read file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini" "SDTray.exe" read file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini" "SDTray.exe" read file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "SDTray.exe" read file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "SDTray.exe" read file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini"46:T746,"spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "BOOTEXECUTE"; Value: "autocheck autochk *") "spybotsd-2.7.64.0.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\") "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "SDTRAY"; Value: ""%PROGRAMFILES%\Spybot - Search & Destroy 2\SDTray.exe"") "spybotsd-2.7.64.0.tmp" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\SDECON32") "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKCR\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\SDECON32"; Key: "(DEFAULT)"; Value: "{44176360-2BBF-4EC1-93CE-384B8681A0BC}"), "spybotsd-2.7.64.0.tmp" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\SDECON32"), "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKCR\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\SDECON32"; Key: "(DEFAULT)"; Value: "{44176360-2BBF-4EC1-93CE-384B8681A0BC}"), "spybotsd-2.7.64.0.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\SDWINLOGON"), "spybotsd-2.7.64.0.tmp" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY"), "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\SDWINLOGON"; Key: "DLLNAME"; Value: "SDWinLogon.dll"), "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\SDWINLOGON"; Key: "STARTUP"; Value: "StartupHandler"), "spybotsd-2.7.64.0.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\SDWINLOGON"; Key: "ASYNCHRONOUS"; Value: "01000000")47:T8bd,"SDFSSvc.exe" (Access type: "CREATE"; Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "SDFSSvc.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")48:T42d,"xml version="1.0" encoding="UTF-8" ?> Spybot Windows Security Center Integration [method] GetHostsFileLocation\n\n \"SDFSSvc.exe\" wrote 88 bytes to file \"%WINDIR%\\System32\\drivers\\etc\\hosts\": {SDFSSvc.exe} < [method] GetHostsFileLocation = %WINDIR%\\System32\\drivers\\etc\\hosts.","origin":"API Call","relevance":10,"id":"api-32","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"Modifies firewall settings","origin":"Registry Access","mitre_attack_id":"T1112","relevance":9,"id":"registry-12","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wscsvc\" (Indicator: \"wscsvc\")","origin":"File/Memory","mitre_attack_id":"T1044","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"SDWSCSvc.exe\" checked file \"C:\"\n \"SDFSSvc.exe\" checked file \"C:\"\n \"SDUpdSvc.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00022417-00003392-57267-118-004B00AC","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"spybotsd-2.7.64.0.exe\" (UID: 00022264-00003820)\n Spawned process \"spybotsd-2.7.64.0.tmp\" with commandline \"/SL5=\"$500F0\n69389626\n206848\nC:\\spybotsd-2.7.64.0.exe\"\" (UID: 00022417-00003392)\n Spawned process \"SDTray.exe\" (UID: 00029845-00003004)\n Spawned process \"SDWSCSvc.exe\" with commandline \"/install\" (UID: 00029849-00002712)\n Spawned process \"SDFSSvc.exe\" (UID: 00029934-00003208)\n Spawned process \"SDWSCSvc.exe\" (UID: 00030671-00003780)\n Spawned process \"SDUpdSvc.exe\" (UID: 00030819-00002900)\n Spawned process \"SDWelcome.exe\" (UID: 00031928-00000320)\n Spawned process \"SDUpdate.exe\" with commandline \"/autoupdate\" (UID: 00031944-00002164)\n Spawned process \"SDWelcome.exe\" (UID: 00031957-00002824)\n Spawned process \"SDUpdate.exe\" with commandline \"/autoupdate\" (UID: 00031980-00003704)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the keyboard layout followed by a significant code branch decision","description":"Found API call GetKeyboardLayout@USER32.DLL directly followed by \"cmp ebx, dword ptr [00503A9Ch]\" and \"je 00452916h\" at 00017907-00003916-63142-5264-004528E8\n Found API call GetKeyboardLayout@user32.dll directly followed by \"cmp ebx, dword ptr [00536F80h]\" and \"je 004A8392h\" at 26851-6749-004A8364","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-61","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.DLL at 00017907-00003916-63142-5372-0045C584\n GetKeyboardState@USER32.DLL at 00017907-00003916-63142-5426-004606FC\n GetKeyboardState@user32.dll at 26851-6593-0040D394\n GetKeyboardState@user32.dll at 26851-6598-004BE05C\n GetKeyboardState@user32.dll at 26851-6590-004B9B84","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00017907-00003916-63142-6118-00480E38","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64479eede5a8e3c0dd081fd2"},{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64479eede5a8e3c0dd081fd2"},{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"64479eede5a8e3c0dd081fd2"},{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64479eede5a8e3c0dd081fd2"},{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]}]},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":27,"imported_dlls_count":153,"dropped_files_count":0,"extracted_files_count":57,"files_written_count":309,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":12,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["windows-server-utility","evasive","adware","kraddare","tearspear"],"sample_flags":["Extracted Files","User Comment","Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"64479eede5a8e3c0dd081fd2","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":75,"submit_name":"spybotsd-2.7.64.0.exe","analysis_start_time":"2023-04-25T09:50:54+00:00","indicators_count":{"informative":125,"suspicious":19,"malicious":1},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5ce18ef4038838a90b4e7eb7","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.DOMG","contacted_countries":["CAN","FRA"],"submit_name":"spybotsd-2.7.64.0.exe","analysis_start_time":"2019-05-19T17:14:06+00:00","indicators_count":{"informative":40,"suspicious":43,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5cb90949028838895b780b3d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":100,"contacted_countries":["CAN","FRA","USA"],"submit_name":"spybotsd-2.7.64.0-1.exe","analysis_start_time":"2019-04-18T23:33:55+00:00","indicators_count":{"informative":41,"suspicious":46,"malicious":15},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5ba0c2807ca3e115c17a1dc6","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":95,"malware_family":"Trojan.DOMG","contacted_countries":["CAN"],"submit_name":"spybotsd-2.7.64.0.exe","analysis_start_time":"2018-09-18T11:17:22+00:00","indicators_count":{"informative":19,"suspicious":19,"malicious":2},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"167.114.117.64","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"address":"64.233.160.0","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"address":"5.196.84.219","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]}],"dns_resolutions":[{"domain":"updates3.safer-networking.org","address":"5.196.84.219","ttl":2404,"country":"France","registrar_name":"OVH","registrar_name_servers":"DNS18.OVH.NET","registrar_creation_date":"2003-06-23T13:41:49+00:00","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"domain":"www.safer-networking.org","address":"167.114.117.64","ttl":3601,"country":"Canada","registrar_name":"OVH","registrar_name_servers":"DNS18.OVH.NET","registrar_creation_date":"2003-06-23T13:41:49+00:00","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]}],"http_requests":[{"host":"www.safer-networking.org","host_ip":"167.114.117.64:80","url":"/spybot2allocator.php?current_version","method":"GET","header":"GET /spybot2allocator.php?current_version HTTP/1.1\nConnection: Keep-Alive\nContent-Type: text/plain; Charset=UTF-8\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nContent-Length: 1\nHost: www.safer-networking.org","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"host":"updates3.safer-networking.org","host_ip":"5.196.84.219:80","url":"/spybotsd2.uid","method":"GET","header":"GET /spybotsd2.uid HTTP/1.0\nHost: updates3.safer-networking.org\nKeep-Alive: 300\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030904 Firebird/0.6.1+\nReferer: http://www.safer-networking.org/index.php?page=download","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"host":"updates3.safer-networking.org","host_ip":"5.196.84.219:80","url":"/CookiesSBL.sbs","method":"GET","header":"GET /CookiesSBL.sbs HTTP/1.0\nHost: updates3.safer-networking.org\nKeep-Alive: 300\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5b) Gecko/20030904 Firebird/0.6.1+\nReferer: http://www.safer-networking.org/index.php?page=download","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}],"processes":[{"pid":3820,"ppid":0,"name":"spybotsd-2.7.64.0.exe","command_line":"","sha256":"770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d","normalized_path":"C:\\spybotsd-2.7.64.0.exe","uid":"00022264-00003820","icon":"$4a"},{"pid":3392,"ppid":3820,"name":"spybotsd-2.7.64.0.tmp","command_line":"/SL5=\"$500F0,69389626,206848,C:\\spybotsd-2.7.64.0.exe\"","sha256":"4056b696a6f0cf25da18072232dcff384d1c73ac2f3346b076e39c3630752454","normalized_path":"%TEMP%\\is-KFHU8.tmp\\spybotsd-2.7.64.0.tmp","parent_uid":"00022264-00003820","uid":"00022417-00003392"},{"pid":3004,"ppid":3392,"name":"SDTray.exe","command_line":"","sha256":"ae6ba7c0a7e10e2197cf21c5ba98630a14c366d0d3402eea0feb42b6aad3827b","normalized_path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDTray.exe","parent_uid":"00022417-00003392","uid":"00029845-00003004"},{"pid":2712,"ppid":3392,"name":"SDWSCSvc.exe","command_line":"/install","sha256":"3286992fb5375fc4571374eef07046dc8b092f47251d0528ad6256244918650e","normalized_path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDWSCSvc.exe","parent_uid":"00022417-00003392","uid":"00029849-00002712"},{"pid":320,"ppid":3392,"name":"SDWelcome.exe","command_line":"","sha256":"141c6c3bb086d3995e1b9ac53111754e63134500a64bc9c70c330df39e3ce06e","normalized_path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDWelcome.exe","parent_uid":"00022417-00003392","uid":"00031928-00000320"},{"pid":2164,"ppid":3392,"name":"SDUpdate.exe","command_line":"/autoupdate","sha256":"eb70d40988aac997cd83d017e6615541b2b221cda02af95a5336664ba7294196","normalized_path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDUpdate.exe","parent_uid":"00022417-00003392","uid":"00031944-00002164"},{"pid":2824,"ppid":3392,"name":"SDWelcome.exe","command_line":"","sha256":"141c6c3bb086d3995e1b9ac53111754e63134500a64bc9c70c330df39e3ce06e","normalized_path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDWelcome.exe","parent_uid":"00022417-00003392","uid":"00031957-00002824"},{"pid":3704,"ppid":3392,"name":"SDUpdate.exe","command_line":"/autoupdate","sha256":"eb70d40988aac997cd83d017e6615541b2b221cda02af95a5336664ba7294196","normalized_path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDUpdate.exe","parent_uid":"00022417-00003392","uid":"00031980-00003704"},{"pid":3208,"ppid":0,"name":"SDFSSvc.exe","command_line":"","sha256":"f7519b9ebf7afd88d67cbad340c562274c6c7bac4ac98eaaf98da3fa6b376c6e","normalized_path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDFSSvc.exe","uid":"00029934-00003208","icon":"$4b"},{"pid":3780,"ppid":0,"name":"SDWSCSvc.exe","command_line":"","sha256":"3286992fb5375fc4571374eef07046dc8b092f47251d0528ad6256244918650e","normalized_path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDWSCSvc.exe","uid":"00030671-00003780","icon":"$4c"},{"pid":2900,"ppid":0,"name":"SDUpdSvc.exe","command_line":"","sha256":"133f59824dd61683c93ac86a36f9c94806d49331d62a4c21f527858c87774aad","normalized_path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDUpdSvc.exe","uid":"00030819-00002900","icon":"$4d"}],"all_imported_dlls":["user32.dll","kernel32.dll","VxSSL32.dll","SHCore.dll","TextInputFramework.dll","ucrtbase.dll","sspicli.dll","msvcrt.dll","msctf.dll","WinTypes.dll","wow64.dll","rpcrt4.dll","imm32.dll","uxtheme.dll","cryptbase.dll","sechost.dll","advapi32.dll","ws2_32.dll","CoreMessaging.dll","win32u.dll","shell32.dll","cfgmgr32.dll","kernel.appcore.dll","CoreUIComponents.dll","clbcatq.dll","KernelBase.dll","gdi32full.dll","shlwapi.dll","profapi.dll","ntmarta.dll","fltLib.dll","ole32.dll","ntdll.dll","wow64win.dll","oleaut32.dll","gdi32.dll","comctl32.dll","windows.storage.dll","wow64cpu.dll","msvcp_win.dll","combase.dll","bcryptprimitives.dll","powrprof.dll","dwmapi.dll","lpk.dll","winnsi.dll","slc.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","usp10.dll","RstrtMgr.dll","dnsapi.dll","mstask.dll","netprofm.dll","urlmon.dll","rpcss.dll","FWPUCLNT.DLL","libeay32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","comdlg32.dll","IPHLPAPI.DLL","userenv.dll","api-ms-win-downlevel-version-l1-1-0.dll","mpr.dll","taskschd.dll","bcrypt.dll","oleacc.dll","srvcli.dll","netapi32.dll","tzres.dll","SensApi.dll","mlang.dll","duser.dll","msvcr100.dll","secur32.dll","wtsapi32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","netmsg.dll","dui70.dll","setupapi.dll","normaliz.dll","atl.dll","vsstrace.dll","gpapi.dll","api-ms-win-core-synch-l1-2-0.dll","linkinfo.dll","npmproxy.dll","wscisvif.dll","wininet.dll","apphelp.dll","ntshrui.dll","iertutil.dll","jsproxy.dll","spp.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","oleaccrc.dll","nlaapi.dll","wshqos.dll","devrtl.dll","RpcRtRemote.dll","sfc.dll","cabinet.dll","msftedit.dll","sfc_os.dll","propsys.dll","bdcore.dll","wintrust.dll","vssapi.dll","cryptnet.dll","dhcpcsvc.dll","tiptsf.dll","WSHTCPIP.DLL","wkscli.dll","samcli.dll","winhttp.dll","cryptsp.dll","wsock32.dll","version.dll","credssp.dll","msasn1.dll","devobj.dll","Wldap32.dll","bdquar.dll","msimg32.dll","wship6.dll","netutils.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rsaenh.dll","xmllite.dll","api-ms-win-downlevel-user32-l1-1-0.dll","wscapi.dll","shdocvw.dll","sqlite3.dll","BDSmartDB.dll","webio.dll","ExplorerFrame.dll","winmm.dll","ssleay32.dll","SDLicense.dll","imageres.dll","mswsock.dll","rasadhlp.dll","imagehlp.dll","crypt32.dll","shfolder.dll","nsi.dll","cscapi.dll","olepro32.dll","psapi.dll","ncrypt.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","srclient.dll","dhcpcsvc6.dll","scan.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"spybotsd-2.7.64.0.tmp","sha256":"4056b696a6f0cf25da18072232dcff384d1c73ac2f3346b076e39c3630752454","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64479eede5a8e3c0dd081fd2"}]},{"name":"SDTasks.dll","sha256":"6b968ae8e436aab7ae2c8be44744297d9f0d0b17e939364ff37bceb9b7d30a7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"System Scan.lnk","sha256":"bcf08c74b0a458d001b94e293c93e75b20bb850811e0f1cded3f0a8c32cd3d27","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Create System Report.lnk","sha256":"e601312980ad9a6fc9ac5cf523a6242a96a9136541f100519185fd25e32e7d30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"File Scan.lnk","sha256":"ef737bf664175b57757ca5a5328ab47c514020a0f312a1f5ffdc195ec34962aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Immunization.lnk","sha256":"7e75068f927ebf9d5a1f90ec589732bd385c09be1a4cea74480d12aa386f382b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Rootkit Scan.lnk","sha256":"06a4de21092ac45b8004297c0caff27f95755977118ef18e774d01c84ee2d92a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Firewall.log","sha256":"ac95a929a649f2eced7655a103f686a068ed088c533f5e1f7b9f5da3647eceac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Updates.log","sha256":"1ed2ae75285e4b9d30f408e9d39913e7c779f12caef752d3ecf28ef1a3f5101f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-QML6M.tmp","sha256":"d8577fa1bafc1c0c7e2240e05c189f2c56bea37c86e109f56ddaf927f1af14a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"is-199O7.tmp","sha256":"910ef8cf98a2ec4ea6c6c61684a41b947584454d507a5c90838d2d86eecf9429","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"is-I2HN0.tmp","sha256":"1f566518e0c5c980bb4d0405bf9483d0e6e22ea07e9d8675fad29165e692787e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"is-PNTKL.tmp","sha256":"b2c8891834b1f4e3958d3657f75ab8cc4e7214278f4b0344d25db1b7f07587e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"is-0L18I.tmp","sha256":"d167a000f5026ef35f47b85aba740bd59c69e69dc782d17249e39b73d3bd5122","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"is-4H1RI.tmp","sha256":"1805dba5a97679d74059a81fa5deef48aa3e1fd9764deb446d42bb23e0608ba2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"is-AQ298.tmp","sha256":"ffd98c21573191241bd0d52d2823214f7af0ca6bfb79e8d3a15fe063b2fc091c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"is-C9SJU.tmp","sha256":"3c8973c8389bcb97cef4442b65455bb16019800150c967b9c702098c89b0cdab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"is-R05C1.tmp","sha256":"4f361d26dec1307d0ebd478b27f78e5a3dfe3e3d7999706d8dddf6a07d63a468","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"is-4MOJ4.tmp","sha256":"de1cc7550a9e49c7cf549d18eca08e6f90dd4c86dc294c344f544acf9877ce62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"is-ERCM1.tmp","sha256":"22d60ce238695a3d68f6d08b9b20ee9c8dd06cf399c4be7db3796f63a4387c49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"QHKCBYBIPRRCAD.scr","sha256":"00a1d9f2c6f7103840babca4d58c2a02ef23588ec9da2f2650265a11f453aa94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"SDFSSvc.exe.log","sha256":"d250b84392bf4d28eba88089a604bbabb83f8944d694ff70c3e126494d64ce17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Spybot-S_D Start Center.lnk","sha256":"16b3f3848cc04f604a50057aed66239a9675b4c4b394ce4c093e857d0e49eef7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Uninstall Spybot-S_D.lnk","sha256":"4513055cea1b3449142d9aa6f104198c7cf6e881d7ec95c80af3fd9b5fc69dd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Tray Icon _Live Protection_.lnk","sha256":"7a86c12116fea61db2058dc403bc88fb674cdbe8e0d82ce13b4c619d7348ac6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-K36MK.tmp","sha256":"1f566518e0c5c980bb4d0405bf9483d0e6e22ea07e9d8675fad29165e692787e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-E8HM5.tmp","sha256":"b7a2b4eba5385c6f08aa5c7b051ecf3340fb2f5010471c05b3ec030794038921","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-N7U9L.tmp","sha256":"df88e5fe9c085fe0150d8f149e1331a80bfcbbcd2c894b0e94ab870705228270","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-O1VNP.tmp","sha256":"b3208e5e5fbfbf30b053d47c163ad0b3bd9fd66b33aa8fbb2669dee237aa936f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-03OB7.tmp","sha256":"5818b142a786e4d368fe0537355956125b980a45f7798ddecc0f7bd9069006ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-1A6L1.tmp","sha256":"910ef8cf98a2ec4ea6c6c61684a41b947584454d507a5c90838d2d86eecf9429","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-EIHPQ.tmp","sha256":"b2c8891834b1f4e3958d3657f75ab8cc4e7214278f4b0344d25db1b7f07587e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-1PP32.tmp","sha256":"53b6b1c3f47a9936acafd1033c0f2a10cd4930e7832e448ab6b1f87db3837b51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-AKVL1.tmp","sha256":"d908859cc5a6cfdff81e0b350ae2c1778201a5bc02fd0d9b5b0c876adde7bf1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-0O8J2.tmp","sha256":"78811217b3245f01d25a8e2dd819df52cad7e73e16696954e4aee7e4cc92e23d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-1D7JI.tmp","sha256":"2c2220a537801c5c6a451fb3807e139083a95acc0decb975d0ac7d65461af73f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-1RCAV.tmp","sha256":"29dce15201d8216ad847275ed8476699cd23ed48109f5362da321094d1327fef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-29GB3.tmp","sha256":"9d59c161a6103caab7404565652281db1ade39822e10b75375f3d35198d1544c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-3CKB5.tmp","sha256":"6a9744d56aa11a336d1bcf68c90bd7764bdfdb474698d1a7f575b071a4418461","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-4CQOA.tmp","sha256":"92748ff3a665e6c62d43fe961a484dede6be493a77fa29f2887f887a7693f00c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-6II07.tmp","sha256":"5239e2bca8cb308d598254c86bda6f687f051a0cc66948b6a04a094f16e4021a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-8J0SB.tmp","sha256":"b1c495a7ad8133f00e37572d5087f8265da077d8aade78eea5061b2116fbde86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-8PCFN.tmp","sha256":"458abad461d6bbdcf9deb911d9ead1f318fed65fbc8709ddfa1906c0f35e3a7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-A75LV.tmp","sha256":"d70a956f1d77428affda4aa8dba5b8f90862a2cbfa4c26cc7dd8ff6e76ba2137","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-A7BD3.tmp","sha256":"89df66c12851f1ab60e056283c7215256f6da6b2256fa26262abedaa9da6fd36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"name":"is-BRL0J.tmp","sha256":"d8577fa1bafc1c0c7e2240e05c189f2c56bea37c86e109f56ddaf927f1af14a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"HIWXLP.scr","sha256":"00a1d9f2c6f7103840babca4d58c2a02ef23588ec9da2f2650265a11f453aa94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-H9IBN.tmp","sha256":"b2c8891834b1f4e3958d3657f75ab8cc4e7214278f4b0344d25db1b7f07587e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-J8CE3.tmp","sha256":"1f566518e0c5c980bb4d0405bf9483d0e6e22ea07e9d8675fad29165e692787e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-PRCT1.tmp","sha256":"910ef8cf98a2ec4ea6c6c61684a41b947584454d507a5c90838d2d86eecf9429","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-IOHHV.tmp","sha256":"1805dba5a97679d74059a81fa5deef48aa3e1fd9764deb446d42bb23e0608ba2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-JAI44.tmp","sha256":"d167a000f5026ef35f47b85aba740bd59c69e69dc782d17249e39b73d3bd5122","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-LOPMJ.tmp","sha256":"3c8973c8389bcb97cef4442b65455bb16019800150c967b9c702098c89b0cdab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-QOUT3.tmp","sha256":"4f361d26dec1307d0ebd478b27f78e5a3dfe3e3d7999706d8dddf6a07d63a468","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-VJ21H.tmp","sha256":"ffd98c21573191241bd0d52d2823214f7af0ca6bfb79e8d3a15fe063b2fc091c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-7DU0L.tmp","sha256":"de1cc7550a9e49c7cf549d18eca08e6f90dd4c86dc294c344f544acf9877ce62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"is-A6HQ8.tmp","sha256":"22d60ce238695a3d68f6d08b9b20ee9c8dd06cf399c4be7db3796f63a4387c49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]}],"files_written":[{"path":"%WINDIR%\\system32\\en\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"C:\\spybotsd-2.7.64.0.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"path":"%WINDIR%\\winsxs\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_en-us_581cd2bf5825dde9\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\shfolder.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\en\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDEvents.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDPEStart.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDScript.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\sdnclean.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\NotificationSpreader.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\vclie150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDECon32.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDQuarantine.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDScanLibrary.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDShell.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\vclx150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\av\\bdquar.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\av\\BDSmartDB.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\av\\BDUpdateServiceCom.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\VirtualTreesDXE150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Help\\Spybot2.chm","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDHelp.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDHookHelper.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDPRE.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDSBIEdit.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\ZMstr190DXE.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\DelZip190.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDBootCD.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDOnAccess.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDSettings.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\vclimg150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\xcacls.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\blindman.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Jcl150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDCleaner.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDHook32.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\av\\scan.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\DEC150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\DelZip192.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDDelFile.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDLists.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDPrepPos.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDResources.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\snlBase150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDPESetup.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\libssl32.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDAdvancedCheckLibrary.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDAV.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDFileScanHelper.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\snlThirdParty150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDHookInst32.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDSysRepair.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\snlFileFormats150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\vcl150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\av\\bdcore.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDImmunizeLibrary.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDPhoneScan.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDTools.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDWinLogon.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\av\\avxdisk.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDShred.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Tools.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\JSDialogPack150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\rtl150.bpl","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDHookDrv32.sys","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\borlndmm.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Help","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Updates","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Updates\\Downloads","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Updates\\Extracts","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Includes","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%TEMP%\\is-KFHU8.tmp\\spybotsd-2.7.64.0.tmp","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\de_DE","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\de_DE\\LC_MESSAGES","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\es_ES","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\es_ES\\LC_MESSAGES","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\fr_FR","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\fr_FR\\LC_MESSAGES","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\hr_HR","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\hr_HR\\LC_MESSAGES","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\hu_HU","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\hu_HU\\LC_MESSAGES","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\it_IT","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\it_IT\\LC_MESSAGES","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\nl_NL","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\nl_NL\\LC_MESSAGES","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\pl_PL","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\pl_PL\\LC_MESSAGES","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\ru_RU","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\ru_RU\\LC_MESSAGES","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\uk_UA","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\locale\\uk_UA\\LC_MESSAGES","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\av","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\av\\Plugins","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Spybot - Search & Destroy","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDFiles.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\GAUBTRTGCCCLO.scr","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDScan.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\is-8NF4A.tmp","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDRootAlyzer.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\QHKCBYBIPRRCAD.scr","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Plugins","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Scripts","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\NKYKEHKOC.scr","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Spybot - Search & Destroy 2","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\unins000.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Spybot - Search & Destroy 2\\Uninstall Spybot-S&D.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Spybot-S&D Start Center.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Spybot - Search & Destroy 2\\Spybot-S&D Start Center.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Spybot - Search & Destroy 2\\Tray Icon (Live Protection).lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Spybot - Search & Destroy 2\\File Scan.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Spybot - Search & Destroy 2\\System Scan.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDImmunize.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Spybot - Search & Destroy 2\\Immunization.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Spybot - Search & Destroy 2\\Rootkit Scan.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDLogReport.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Spybot - Search & Destroy 2\\Create System Report.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\unins000.msg","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDWSCSvc.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDTray.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDFSSvc.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Roaming\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Internet Explorer\\Quick Launch\\Spybot-S&D Start Center.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Internet Explorer\\Quick Launch\\System Scan.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PUBLIC%\\Desktop\\Acrobat Reader DC.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PUBLIC%\\Desktop\\Spybot-S&D Start Center.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Hancom Office Hancell 2010.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Hancom Office Hanshow 2010.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Hancom Office Hanword 2010.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8890A77645B73478F5B1DED18ACBF795_3F584A3392BB586FC541F0F81FC9D443","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\2659C1A560AB92C9C29D4B2B25815AE8","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0270780F846F08BEFE0DD8112D932FEF","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\DA3B6E45325D5FFF28CF6BAD6065C907_030F57FBDF0DCD10807C76FD10EB0D14","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\DA3B6E45325D5FFF28CF6BAD6065C907_017F00EA2254FE9F32F9856D4194715C","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\782AC1F7D5B160B0F71F6F92B0912799","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6E47DC54834F661FE77B461D2DF73D9D","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\DA3B6E45325D5FFF28CF6BAD6065C907_030F57FBDF0DCD10807C76FD10EB0D14","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\DA3B6E45325D5FFF28CF6BAD6065C907_030F57FBDF0DCD10807C76FD10EB0D14","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EE44ECA143B76F2B9F2A5AA75B5D1EC6_5BFB72FAE1BB9D1928D1C5C92F52E8EA","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EE44ECA143B76F2B9F2A5AA75B5D1EC6_D73B49BF15A912442AB00C432A94822B","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\616AD1AB067CFD351D6C0EF6F3E12F40","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\782D7E2BFB036A849A99FFA65C652D39","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\EE44ECA143B76F2B9F2A5AA75B5D1EC6_5BFB72FAE1BB9D1928D1C5C92F52E8EA","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\EE44ECA143B76F2B9F2A5AA75B5D1EC6_5BFB72FAE1BB9D1928D1C5C92F52E8EA","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F7788E201A03EF5036E7C8BF55432CB_BDA62707BA70CB0111D9E81215C5BF30","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F7788E201A03EF5036E7C8BF55432CB_B9DAE4692A573293DF3D4DD40CAF4F19","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F234AF16A662E2448E049CAD14C6D675","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0A47A12B5C7E1616F4B3AE939D5DF475","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\0F7788E201A03EF5036E7C8BF55432CB_BDA62707BA70CB0111D9E81215C5BF30","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\0F7788E201A03EF5036E7C8BF55432CB_BDA62707BA70CB0111D9E81215C5BF30","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Includes\\Cookies.sbs","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Includes\\Domains.sbs","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\Includes\\URL-Blacklist.sbs","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDFSSvc.exe.log","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Spybot - Search & Destroy\\Logs","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Spybot - Search & Destroy\\Logs\\Firewall.log","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDFileScanLibrary.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDLicense.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\license.txt","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDUpdSvc.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\safer-networking-ius.cer","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\branding.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Spybot - Search & Destroy\\Logs\\Updates.log","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDTasks.dll","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDWelcome.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"pipe\\Spybot\\Pipe\\Apps.BfiuQIw.sdwelcome.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SDUpdate.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\profiles.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"pipe\\Spybot\\Pipe\\Apps.BfiuQIw.sdupdate.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\Fonts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PUBLIC%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PUBLIC%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PUBLIC%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%USERPROFILE%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"C:\\Users\\Default","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\SendTo\\Desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%WINDIR%\\syswow64\\en\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%WINDIR%\\SysWOW64\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"C:\\770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%WINDIR%\\SysWOW64\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%WINDIR%\\syswow64\\en\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDFileScanHelper.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDFSSvc.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDHookInst64.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDFileScanLibrary.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDHookInst32.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDUpdate.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDCleaner.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%WINDIR%\\system32\\sdnclean64.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\av\\scan.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDEvents.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDFiles.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDPrepPos.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDRootAlyzer.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDScript.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDLogReport.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDPESetup.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDECon64.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDScan.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDECon32.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDImmunizeLibrary.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDHookHelper.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDPEStart.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDHookDrv64.sys","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDImmunize.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDBootCD.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDHook64.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDHookDrv32.sys","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDOnAccess.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDSettings.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\blindman.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDHook32.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDScanLibrary.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDTray.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDWelcome.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDUpdSvc.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDSBIEdit.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDWinLogon.dll","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%PROGRAMFILES%\\(x86)\\Spybot - Search & Destroy 2\\SDWSCSvc.exe","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"%TEMP%\\is-GUB5A.tmp\\770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d.tmp","sources":[{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"path":"C:\\spybotsd-2.7.64.0-1.exe","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%TEMP%\\is-T0FOG.tmp\\spybotsd-2.7.64.0-1.tmp","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\HBOSVCUTZKQ.scr","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%WINDIR%\\System32\\is-T7DAJ.tmp","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\HIWXLP.scr","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%PROGRAMFILES%\\Spybot - Search & Destroy 2\\SHTRKJNESYTT.scr","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"path":"pipe\\Spybot\\Pipe\\Apps.11xsEsn.sdupdate.exe","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"key":"HKCU\\SOFTWARE\\SAFER NETWORKING LIMITED\\LOCALIZATION\\\\","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"key":"HKU\\SOFTWARE\\SAFER NETWORKING LIMITED\\LOCALIZATION\\\\","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SDSCANNERSERVICE\\","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\SM0:7856:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64479eede5a8e3c0dd081fd2"}]},{"name":"SM0:7856:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64479eede5a8e3c0dd081fd2"}]},{"name":"SM0:7856:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"64479eede5a8e3c0dd081fd2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5ba0c2807ca3e115c17a1dc6"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Spybot2.Apps.Default.BfiuQIw.elevated.sdtray.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"Spybot2.Apps.Default.BfiuQIw.elevated.sdtray.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Spybot2.Apps.Default.BfiuQIw.elevated.sdwelcome.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Spybot2.Apps.Default.BfiuQIw.elevated.sdwelcome.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Spybot2.Apps.Default.BfiuQIw.elevated.sdupdate.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"Spybot2.Apps.Default.BfiuQIw.elevated.sdupdate.exe","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"}]},{"name":"\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ce18ef4038838a90b4e7eb7"},{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Spybot2.Apps.Default.11xsEsn.elevated.sdtray.exe","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Spybot2.Apps.Default.11xsEsn.elevated.sdtray.exe","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Spybot2.Apps.Default.11xsEsn.elevated.sdwelcome.exe","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Spybot2.Apps.Default.11xsEsn.elevated.sdwelcome.exe","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Spybot2.Apps.Default.11xsEsn.elevated.sdupdate.exe","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]},{"name":"Spybot2.Apps.Default.11xsEsn.elevated.sdupdate.exe","sources":[{"report_type":"sandbox","report_id":"5cb90949028838895b780b3d"}]}]}},"report_ids":{"sandbox_job_ids":["5ce18ef4038838a90b4e7eb7","5cb90949028838895b780b3d","5ba0c2807ca3e115c17a1dc6","64479eede5a8e3c0dd081fd2"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 770c55cdd8a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 770c55cdd8a7…. Threat score 100/100. 0/26 AV engines flagged this file. 14 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 770c55cdd8a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 770c55cdd8a7…. Threat score 100/100. 0/26 AV engines flagged this file. 14 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/770c55cdd8a793e4ecdbcd88003631ce30d0940a7965ed56afb36b0d26cbd68d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 770c55cdd8a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 770c55cdd8a7…. Threat score 100/100. 0/26 AV engines flagged this file. 14 malicious and 31 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4e","11",{}]]