24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 7e74f3e8d070… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7e74f3e8d070…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91"],"about":{"@type":"SoftwareApplication","name":"FortiClientOnlineInstaller.exe","applicationCategory":["peexe","autoit","executable"],"identifier":"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T2e22,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "Module32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfA"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "wsprintfW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "AppendMenuW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SHFileOperationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OleInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperW"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadImageW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExW"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevW"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "Module32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynW"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextW"; Source: "sample.bin"), Found reference to API (Indicator: "OleUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFileInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")26:T443,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.008B0000.00000002.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp")27:T5b9,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5231072'}" (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5231008'}" (UID: 00000000-00004264) "Anymore.pif" called "LoadResource with parameter {'hModule': '8519680', 'hResInfo': '9344408'}" (UID: 00000000-00006124) "Anymore.pif" called "LoadResource with parameter {'hModule': '8519680', 'hResInfo': '9344184'}" (UID: 00000000-00006124) "Anymore.pif" called "LoadResource with parameter {'hModule': '8519680', 'hResInfo': '9344440'}" (UID: 00000000-00006124) "Anymore.pif" called "LoadResource with parameter {'hModule': '8519680', 'hResInfo': '9344248'}" (UID: 00000000-00006124) "Anymore.pif" called "LoadResource with parameter {'hModule': '8519680', 'hResInfo': '9344424'}" (UID: 00000000-00006124) "Anymore.pif" called "LoadResource with parameter {'hModule': '8519680', 'hResInfo': '9344232'}" (UID: 00000000-00006124) "Anymore.pif" called "LoadResource with parameter {'hModule': '8519680', 'hResInfo': '9344200'}" (UID: 00000000-00006124) "Anymore.pif" called "LoadResource with parameter {'hModule': '8519680', 'hResInfo': '9344456'}" (UID: 00000000-00006124) "Anymore.pif" called "LoadResource with parameter {'hModule': '8519680', 'hResInfo': '9344216'}" (UID: 00000000-00006124)28:T558,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp")29:Ta5a,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PROPERTYBAG") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\KNOWNFOLDERS") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PROPERTYBAG") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2092356043-4041700817-663127204-1001") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-2092356043-4041700817-663127204-1001") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "DELETEVAL"; Path: "HKLM") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION")2a:Tf16,Assembly shows XOR instruction xor esi ecx in Stream UID: 00000000-00004264-47671-16-0040159C Assembly shows XOR instruction xor ecx 00180000h in Stream UID: 00000000-00004264-47671-37-0040574D Assembly shows XOR instruction xor bp bx in Stream UID: 00000000-00004264-47671-64-004039FC Assembly shows XOR instruction xor ecx 00000080h in Stream UID: 00000000-00004264-47671-83-0040447D Assembly shows XOR instruction xor ecx 01h in Stream UID: 00000000-00004264-47671-83-0040447D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006124-49830-41-0084A3F8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006124-49830-41-0084A3F8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006124-49830-45-00848E89 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006124-49830-45-00848E89 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006124-49830-51-00855CAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006124-49830-51-00855CAC Assembly shows XOR instruction xor eax dword ptr [008E0D50h] in Stream UID: 00000000-00006124-49830-64-0084A05B Assembly shows XOR instruction xor eax dword ptr [008E0D50h] in Stream UID: 00000000-00006124-49830-68-0084A016 Assembly shows XOR instruction xor eax dword ptr [008E0D50h] in Stream UID: 00000000-00006124-49830-71-00849FF7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006124-49830-154-0084DBA5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006124-49830-154-0084DBA5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006124-49830-185-0084B19D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006124-49830-185-0084B19D Assembly shows XOR instruction xor eax dword ptr [008E0D50h] in Stream UID: 00000000-00006124-49830-326-00854C14 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006124-49830-454-0085598B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006124-49830-454-0085598B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006124-49830-464-0085AEC3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006124-49830-464-0085AEC3 Assembly shows XOR instruction xor eax dword ptr [008E0D50h] in Stream UID: 00000000-00006124-49830-465-00854B20 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006124-49830-471-0084F18E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006124-49830-471-0084F18E Assembly shows XOR instruction xor eax dword ptr [008E0D50h] in Stream UID: 00000000-00006124-49830-488-00854B96 Assembly shows XOR instruction xor eax dword ptr [008E0D50h] in Stream UID: 00000000-00006124-49830-489-00854BDF Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00006124-49830-556-0084CD51 Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00006124-49830-556-0084CD51 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00006124-49830-556-0084CD51 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00006124-49830-556-0084CD51 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00006124-49830-745-00845AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00006124-49830-745-00845AF0 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00006124-49830-858-00822BA9 Assembly shows XOR instruction xor ecx edx in Stream UID: 00000000-00006124-49830-891-008A7F6B Assembly shows XOR instruction xor ebx 10h in Stream UID: 00000000-00006124-49830-894-008A73A5 Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00006124-49830-901-008A6BDB2b:T459,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Found Crypto currency wallets related strings Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]2c:T668d,Found XOR loop in file "Anymore.pif" at offset 209727; code bytes = 30d0 Found XOR loop in file "Anymore.pif" at offset 488439; code bytes = 30d0 Found XOR loop in file "Anymore.pif" at offset 624266; code bytes = 30d0 Found XOR loop in file "Anymore.pif" at offset 857601; code bytes = 30d0 Found XOR loop in file "Anymore.pif" at offset 872765; code bytes = 30d0 Found XOR loop in file "Anymore.pif" at offset 881695; code bytes = 30d0 Found XOR loop in file "Anymore.pif" at offset 884303; code bytes = 30d0 Found XOR loop in file "Anymore.pif" at offset 122211; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 243805; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 426397; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 426471; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 426655; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 426708; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 426737; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 546769; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 629178; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 635354; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 643061; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 643509; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 644085; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 644533; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 645285; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 645733; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 646309; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 646757; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 865511; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 874457; code bytes = 33c1 Found XOR loop in file "Anymore.pif" at offset 100479; code bytes = 8030 Found XOR loop in file "Anymore.pif" at offset 606796; code bytes = 8030 Found XOR loop in file "Anymore.pif" at offset 619146; code bytes = 8030 Found XOR loop in file "Anymore.pif" at offset 861962; code bytes = 8030 Found XOR loop in file "Anymore.pif" at offset 866398; code bytes = 8030 Found XOR loop in file "Anymore.pif" at offset 869928; code bytes = 8030 Found XOR loop in file "Anymore.pif" at offset 883204; code bytes = 8030 Found XOR loop in file "Anymore.pif" at offset 884284; code bytes = 8030 Found XOR loop in file "Anymore.pif" at offset 888180; code bytes = 8030 Found XOR loop in file "Anymore.pif" at offset 890356; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 110149; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 200656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 225303; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 380502; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 446284; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 519025; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 566631; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 688709; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 851001; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 851794; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1037480; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1127987; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1152634; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1307833; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1373615; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1446356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1493962; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1616040; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1778332; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1779125; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1964812; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2055319; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2079966; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2235165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2300947; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2373688; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2421294; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2543372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2705664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2706457; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2892144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2982651; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3007298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3162497; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3228279; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3301020; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3348626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3470704; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3632996; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3633789; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3819476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3909983; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3934630; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4089829; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4155611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4228352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4275958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4398036; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4560328; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4561121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4746808; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4837315; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4861962; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5017161; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5082943; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5155684; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5203290; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5325368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5487660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5488453; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5674140; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5764647; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5789294; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5944493; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6010275; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6083016; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6130622; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6252700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6414992; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6415785; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6601472; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6691979; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6716626; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6871825; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6937607; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7010348; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7057954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7180032; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7342324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7343117; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7528804; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7619311; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7643958; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7799157; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7864939; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7937680; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7985286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8107364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8269656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8270449; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8456136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8546643; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8571290; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8726489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8792271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8865012; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 8912618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9034696; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9196988; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9197781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9383468; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9473975; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9498622; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9653821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9719603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9792344; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9839950; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 9962028; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10124320; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10125113; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10310800; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10401307; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10425954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 96280; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 113970; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 138677; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 198839; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 283431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 410327; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 494493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 496782; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 515062; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 539318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 577994; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 688030; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 763947; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1023611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1041301; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1066008; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1126170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1210762; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1337658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1421824; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1424113; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1442393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1466649; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1505325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1615361; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1691278; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1950943; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1968633; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1993340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2053502; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2138094; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2264990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2349156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2351445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2369725; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2393981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2432657; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2542693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2618610; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2878275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2895965; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2920672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2980834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3065426; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3192322; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3276488; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3278777; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3297057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3321313; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3359989; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3470025; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3545942; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3805607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3823297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3848004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3908166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3992758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4119654; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4203820; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4206109; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4224389; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4248645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4287321; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4397357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4473274; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4732939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4750629; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4775336; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4835498; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4920090; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5046986; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5131152; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5133441; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5151721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5175977; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5214653; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5324689; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5400606; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5660271; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5677961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5702668; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5762830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5847422; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5974318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6058484; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6060773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6079053; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6103309; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6141985; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6252021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6327938; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6587603; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6605293; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6630000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6690162; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6774754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6901650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6985816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6988105; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7006385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7030641; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7069317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7179353; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7255270; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7514935; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7532625; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7557332; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7617494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7702086; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7828982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7913148; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7915437; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7933717; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7957973; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7996649; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8106685; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8182602; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8442267; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8459957; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8484664; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8544826; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8629418; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8756314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8840480; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8842769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8861049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8885305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 8923981; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9034017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9109934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9369599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9387289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9411996; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9472158; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9556750; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9683646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9767812; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9770101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9788381; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9812637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9851313; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9961349; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10037266; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10296931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10314621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10339328; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10399490; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10484082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 125433; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 161729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 596489; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 726574; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 772522; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1052764; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1089060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1523820; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1653905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1699853; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1980096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2016392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2451152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2581237; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2627185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2907428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2943724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3378484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3508569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3554517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3834760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3871056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4305816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4435901; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4481849; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4762092; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4798388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5233148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5363233; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5409181; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5689424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5725720; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6160480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6290565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6336513; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6616756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6653052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7087812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7217897; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7263845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7544088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7580384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8015144; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8145229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8191177; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8471420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8507716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 8942476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9072561; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9118509; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9398752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9435048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9869808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 9999893; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10045841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10326084; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 10362380; code bytes = 80302d:T454,Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00006124.00000003.80595.00821000.00000020.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00006124.00000003.80595.00821000.00000020.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp")2e:T1f4f,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600013e1e1714dc12006d829275dcc6200004010000 (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000320034003500300066003200380066003700390065006500380034006500640066003300650030006500610037006300360032006200640037006600390031002e00650078006500000000000000000000000000000000000000000000000000000000000000ff2b6d7757fa7677d8eb8f75ac011b0000001b00000000000000000014009800ff0100000000000000000000000000000000000015009300ff0100000000000000000000606f1b000000000020000000000000000000000088eb1e00506c1b00706d1b0098cd200018711b0000000000b0c612000000000030c81200 (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000300000064e4d60170e4d60138e6d60192e0a36bfa94a87cfeffffffb8e5d60116bca26bb6bf3f4401000000ece4d601b8e5d60120bca26b0600000000008f6a010000002fbca26b2a00000006000000b6bf3f4401000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004000000010000000000000001cf6d6c0c2461706952657475726e0000000000000000000000000000000000000000000002000000 (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4e5d601000000008e00000044e6d601feffffffcce5d601cf006e77d6006e77afd8b2768e0000004700000044e6d60100000000a0e5d6010000000008e6d60195e169777b3b0900feffffffd6006e772f7b6f75010000004300ec00167b6f752303da16 (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000018b32400aceed60104646d7738011b00e0636d77cfd3b2760000000000001b0020b324006dd183770b0bda166caecb75000000000000000004020000b8c42400302f1b000100000000001b0050011b000c00000020b32400302f1b000200000218000000667b001d820000000000000000000000030000004ceed601820000007f07000000000000667b001d02000000c0758b77b8c4240000000000c0758b7768eed60140301b0000000000302f1b00c0eed601ff2b6d7797d3b2767400000004021b0000001b003300c20001000000000000001000000000000101ccedd601 (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004264) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002304) "cmd.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002a0018000000aa000000000000000000000088eb2d00506b2a00b86c2a00181d300068772a006100730034d32100690073003ce02100181d3000e9e96d77181d300000000000aa00000060d4210098d8210000000000000000000000000000000000000000000000000000000000000000001c5c6c7760d86f75ffffffff1700000010d42100240000000300000000d921002cde210098d82100860000003cd4210096ed6d773a1d3000a06a43758600000060d4210098d821000000000086008800a06a437560d42100916c43753a1d3000a06a4375a06a4375d0d8210002020000 (UID: 00000000-00002304) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002304) "tasklist.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003420)2f:T7c3,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb8f7598cd200000f0fd7f9a5c6e7700e0fd7ff4c7120044f0fd7f00000000400000003f0000001e00000000f0fd7fe8c71200c15c6e77608275771e00000000f0fd7f9a5c6e7700e0fd7f0cc8120057896d778083757713177075d8eb8f75 (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004264) "Anymore.pif" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006124) "Anymore.pif" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006124) "Anymore.pif" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb8f753841c2000030fd7f9a5c6e7700f0fd7f486353004430fd7f00000000400000003f0000002d0000000030fd7f3c635300c15c6e77608275772d0000000030fd7f9a5c6e7700f0fd7f6063530057896d778083757713177075d8eb8f75 (UID: 00000000-00006124)30:T594,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tasklist.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Anymore.pif" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Anymore.pif" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")31:T638,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.008B0000.00000002.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.008B0000.00000002.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp")32:T67b,OpenProcess@KERNEL32.DLL at 00000000-00004264-47671-48-00405C70 GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1126-008599D2 GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1345-008788CD GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1346-00878D89 GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1347-00878E89 GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1348-00878EBD GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1349-00878E20 GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1350-00878ACA GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1351-00878CC7 GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1352-00878D28 GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1355-00879274 OpenProcessToken@ADVAPI32.DLL at 00000000-00006124-49830-1357-00879330 GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1359-008794D9 GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1360-00879431 OpenProcessToken@ADVAPI32.DLL at 00000000-00006124-49830-1363-008791CF GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-1364-0087954A OpenProcess@KERNEL32.DLL at 00000000-00006124-49830-1384-00881BDD OpenProcess@KERNEL32.DLL at 00000000-00006124-49830-1592-008859A4 OpenProcess@KERNEL32.DLL at 00000000-00006124-49830-2008-0089F01C OpenProcess@KERNEL32.DLL at 00000000-00006124-49830-2010-0089F23E OpenProcess@KERNEL32.DLL at 00000000-00006124-49830-2013-0089F6E8 OpenProcess@KERNEL32.DLL at 00000000-00006124-49830-2016-0089F856 GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-2446-00847E83 GetProcessHeap@KERNEL32.DLL at 00000000-00006124-49830-2458-00848DAC33:T736,"Anymore.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "Anymore.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "Anymore.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "Anymore.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "Anymore.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "Anymore.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Anymore.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Anymore.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Anymore.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Anymore.pif" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")34:T747,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "Anymore.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYNAME") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\7-ZIP"; Key: "DISPLAYVERSION") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK"; Key: "DISPLAYNAME") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYNAME") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE AIR"; Key: "DISPLAYVERSION") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYNAME") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER ACTIVEX"; Key: "DISPLAYVERSION") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE SHOCKWAVE PLAYER")35:T580,"Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "Anymore.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "Anymore.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Anymore.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Anymore.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "Anymore.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "Anymore.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "Anymore.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "Anymore.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "Anymore.pif" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "Anymore.pif" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")36:T7f7,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00004264) "Anymore.pif" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\GCAEHDBAAECB (UID: 00000000-00006124) "Anymore.pif" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00006124) "Anymore.pif" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00006124) "Anymore.pif" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00006124) "Anymore.pif" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00006124) "Anymore.pif" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00006124) "Anymore.pif" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00006124) "Anymore.pif" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00006124)37:T59e,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "CreateProcessW" with parameter ""%WINDIR%\System32\cmd.exe" /k move Dvd Dvd.cmd & Dvd.cmd & exit" - (UID: 00000000-00004264) "cmd.exe" called "CreateProcessW" with parameter "tasklist" - (UID: 00000000-00002304) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "wrsa.exe opssvc.exe"" - (UID: 00000000-00002304) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"" - (UID: 00000000-00002304) "cmd.exe" called "CreateProcessW" with parameter "cmd /c md 73376" - (UID: 00000000-00002304) "cmd.exe" called "CreateProcessW" with parameter "findstr /V "SNAPSHOTGENTLYFITNESSINCORPORATE" Confirmed" - (UID: 00000000-00002304) "cmd.exe" called "CreateProcessW" with parameter "cmd /c copy /b ..\Lbs + ..\Gifts + ..\Pizza + ..\Lane + ..\Tablets + ..\Terrain W" - (UID: 00000000-00002304) "cmd.exe" called "CreateProcessW" with parameter "Anymore.pif W" - (UID: 00000000-00002304) "cmd.exe" called "CreateProcessW" with parameter "choice /d y /t 5" - (UID: 00000000-00002304) "Anymore.pif" called "CreateProcessW" with parameter ""%WINDIR%\system32\cmd.exe" /c timeout /t 10 & del /f /q "%TEMP%\73376\Anymore.pif" & rd /s /q "C:\" - (UID: 00000000-00006124), "cmd.exe" called "CreateProcessW" with parameter "timeout /t 10" - (UID: 00000000-00004024)38:T24cc,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004264) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002304) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003420) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003420) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00003420) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tasklist.exe (UID: 00000000-00003420) "tasklist.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003420) "tasklist.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003420) "tasklist.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003420) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003776) "tasklist.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003776) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00003776) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\tasklist.exe (UID: 00000000-00003776) "tasklist.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003776) "tasklist.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003776) "tasklist.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003776) "Anymore.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter %TEMP%\73376\W (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter explorer.exe (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter %WINDIR%\system32\ntshrui.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter netutils.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00006124) "Anymore.pif" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00006124) "choice.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\choice.exe (UID: 00000000-00006112)39:Td50f,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004264) "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004264) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002304) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002304) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002304) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002304) "cmd.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00002304) "cmd.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00002304) "cmd.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00002304) "tasklist.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003420) "tasklist.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00003420) "findstr.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002768) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003776) "tasklist.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00003776) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001400) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001400) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001400) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001400) "Anymore.pif" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ImmIsIME (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateFileMapping (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RtlGetCompressionWorkSpaceSize (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RtlDecompressFragment (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ZwQueryInformationProcess (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ??_U@YAPAXI@Z (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter strchr (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter srand (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter rand (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter strncpy (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter malloc (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter _wtoi64 (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter atexit (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ??_V@YAXPAX@Z (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter memchr (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter strcpy_s (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter __CxxFrameHandler3 (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter strtok_s (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter memmove (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter strlen (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter memset (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter lstrlenW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter VirtualQueryEx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter wsprintfW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CharToOemA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetCurrentHwProfileA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SHFileOperationA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter OpenEventA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetUserDefaultLangID (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter VirtualAllocExNuma (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateDCA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CryptStringToBinaryA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter sscanf (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GlobalSize (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetSystemPowerStatus (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetFileSizeEx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetLogicalProcessorInformationEx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GdipGetImageEncodersSize (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GdipGetImageEncoders (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GdipCreateBitmapFromHBITMAP (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GdipSaveImageToStream (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GdipFree (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetHGlobalFromStream (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateStreamOnHGlobal (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptGenerateSymmetricKey (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptCloseAlgorithmProvider (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptDecrypt (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptSetProperty (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CloseWindow (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CharToOemW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CryptBinaryToStringA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SHGetFolderPathA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InternetConnectA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InternetCloseHandle (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter HttpSendRequestA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter HttpOpenRequestA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InternetCrackUrlA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter HttpQueryInfoA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InternetSetOptionA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter StrCmpCA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter StrStrA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter StrCmpCW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter PathMatchSpecA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SymMatchString (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EnumerateSecurityPackagesA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter AcquireCredentialsHandleA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CertControlStore (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InitializeSecurityContextA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter QueryContextAttributesA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter HTTPSCertificateTrust (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter HTTPSFinalProv (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SslLookupCipherSuiteInfo (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SslLookupCipherLengths (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SealMessage (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SslEncryptPacket (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter UnsealMessage (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SslDecryptPacket (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter BCryptGenRandom (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetRngInterface (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter NetShareGetInfo (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetNamedSecurityInfoW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00006124) "Anymore.pif" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00006124) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00004024) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004024) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00004024) "timeout.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003872) "timeout.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003872) "timeout.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003872) "timeout.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003872)3a:T48d,"Select * From Win32_OperatingSystem" (Source: 00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp, Indicator: "select * from win32_operatingsystem") "Select * From AntiVirusProduct" (Source: 00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.00DF0000.00000004.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp, Indicator: "select * from antivirusproduct") "SELECT target_path, tab_url from downloads" (Source: 00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp, Indicator: "select target_path, tab_url from downloads") "SELECT service, encrypted_token FROM token_service" (Source: 00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp, Indicator: "select service, encrypted_token from token_service")3b:T5b0,Sleep@KERNEL32.DLL at 00000000-00004264-47671-16-0040159C SetTimer at 00000000-00004264-47671-50-00402DB4 Sleep@KERNEL32.DLL at 00000000-00006124-49830-66-0084A362 Sleep@KERNEL32.DLL at 00000000-00006124-49830-132-008644DF Sleep@KERNEL32.DLL at 00000000-00006124-49830-578-00882BAF Sleep@KERNEL32.DLL at 00000000-00006124-49830-636-008857FF WaitForSingleObject@KERNEL32.DLL at 00000000-00006124-49830-692-008877EB WaitForSingleObject@KERNEL32.DLL at 00000000-00006124-49830-696-00892E47 SetTimer at 00000000-00006124-49830-858-00822BA9 Sleep@KERNEL32.DLL at 00000000-00006124-49830-1058-0082E00D Sleep@KERNEL32.DLL at 00000000-00006124-49830-1062-0082E36D SetTimer at 00000000-00006124-49830-1168-00834D83 Sleep@KERNEL32.DLL at 00000000-00006124-49830-1170-00882CCE SetTimer at 00000000-00006124-49830-1174-00835B29 Sleep@KERNEL32.DLL at 00000000-00006124-49830-1330-0087729E WaitForSingleObject@KERNEL32.DLL at 00000000-00006124-49830-1364-0087954A Sleep@KERNEL32.DLL at 00000000-00006124-49830-1366-008795D7 Sleep@KERNEL32.DLL at 00000000-00006124-49830-1391-0087A226 SetTimer at 00000000-00006124-49830-1448-0087CB97 Sleep@KERNEL32.DLL at 00000000-00006124-49830-1520-00881941 WaitForSingleObject@KERNEL32.DLL at 00000000-00006124-49830-1581-0088504E Sleep@KERNEL32.DLL at 00000000-00006124-49830-1586-00885530 Sleep@KERNEL32.DLL at 00000000-00006124-49830-1637-0088FA36 Sleep@KERNEL32.DLL at 00000000-00006124-49830-1647-0088B8003c:T482,LoadLibraryA@KERNEL32.DLL at 00000000-00004264-47671-5-00405BBF LoadLibraryExW@KERNEL32.DLL at 00000000-00004264-47671-16-0040159C LoadLibraryA@KERNEL32.DLL at 00000000-00004264-47671-48-00405C70 LoadLibraryExW@KERNEL32.DLL at 00000000-00006124-49830-51-00855CAC LoadLibraryA@KERNEL32.DLL at 00000000-00006124-49830-507-0089C6D9 LoadLibraryExW@KERNEL32.DLL at 00000000-00006124-49830-883-008ABE70 LoadLibraryW@KERNEL32.DLL at 00000000-00006124-49830-885-008A6A0C LoadLibraryExW@KERNEL32.DLL at 00000000-00006124-49830-1148-008349C2 LoadLibraryA@KERNEL32.DLL at 00000000-00006124-49830-1150-00834BAA LoadLibraryA@KERNEL32.DLL at 00000000-00006124-49830-1152-00834B77 LoadLibraryA@KERNEL32.DLL at 00000000-00006124-49830-1192-008355F0 LoadLibraryExW@KERNEL32.DLL at 00000000-00006124-49830-1228-0084428E LoadLibraryExW@KERNEL32.DLL at 00000000-00006124-49830-1232-008441B9 LoadLibraryA@KERNEL32.DLL at 00000000-00006124-49830-1978-008997CA LoadLibraryW@KERNEL32.DLL at 00000000-00006124-49830-1988-0089DFB1 LoadLibraryW@KERNEL32.DLL at 00000000-00006124-49830-2001-0089EB20 LoadLibraryA@KERNEL32.DLL at 00000000-00006124-49830-2033-008A14473d:T56d,Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "LockResource" (Indicator: "LockResource"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "FindResourceExW" (Indicator: "FindResource"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp")3e:T7bd,"Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004264.00000000.74831.001B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004264.00000000.74831.001B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00004264.00000000.74831.00408000.00000002.mdmp "SOFTWARE\monero-project\monero-core" in Source: 00000000-00006124.00000002.79528.02CD0000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00006124.00000002.79528.02CD0000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration" in Source: 00000000-00006124.00000002.79528.02CD0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00006124.00000002.79528.02CD0000.00000004.mdmp "SOFTWARE\monero-project\monero-core" in Source: 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration" in Source: 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00006124.00000003.80595.008B0000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00006124.00000003.80595.008B0000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00006124.00000003.80595.008B0000.00000002.mdmp "SOFTWARE\monero-project\monero-core" in Source: 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration" in Source: 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp3f:T12f3,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "OLEAUT32.DLL" at base 75bc0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "ADVAPI32.DLL" at base 761e0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 777f0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "SETUPAPI.DLL" at base 75980000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "RPCRT4.DLL" at base 75e00000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "CLBCATQ.DLL" at base 75b20000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 741c0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "NTMARTA.DLL" at base 749f0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76530000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "PROFAPI.DLL" at base 755a0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "SHELL32.DLL" at base 76a30000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "PROPSYS.DLL" at base 741c0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "APPHELP.DLL" at base 75430000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "KERNEL32.DLL" at base 777f0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "COMCTL32.DLL" at base 74480000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 6a8f0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75680000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75cb0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "SECUR32.DLL" at base 752b0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 756a0000 "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75430000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 761e0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 777f0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 75430000 "tasklist.exe" loaded module "ADVAPI32.DLL" at base 761e0000 "tasklist.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76530000 "tasklist.exe" loaded module "CLBCATQ.DLL" at base 75b20000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 777f0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d210000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 754f0000 "tasklist.exe" loaded module "KERNEL32.DLL" at base 777f0000 "tasklist.exe" loaded module "CRYPTSP.DLL" at base 74f90000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74d20000 "tasklist.exe" loaded module "CRYPTBASE.DLL" at base 75480000 "tasklist.exe" loaded module "RPCRTREMOTE.DLL" at base 75520000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6c870000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6d710000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6dec0000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 75e00000 "tasklist.exe" loaded module "OLEAUT32.DLL" at base 75bc0000 "findstr.exe" loaded module "KERNEL32.DLL" at base 777f0000 "Anymore.pif" loaded module "CRYPTBASE.DLL" at base 75480000 "Anymore.pif" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74380000 "Anymore.pif" loaded module "KERNEL32.DLL" at base 777f0000 "Anymore.pif" loaded module "DWMAPI.DLL" at base 74130000 "Anymore.pif" loaded module "COMCTL32.DLL" at base 74480000 "Anymore.pif" loaded module "UXTHEME.DLL" at base 74380000 "Anymore.pif" loaded module "IMM32.DLL" at base 764d0000 "Anymore.pif" loaded module "COMCTL32" at base 74480000 "Anymore.pif" loaded module "SHELL32.DLL" at base 76a30000 "Anymore.pif" loaded module "OLE32.DLL" at base 76680000 "Anymore.pif" loaded module "PSAPI.DLL" at base 75bb0000 "Anymore.pif" loaded module "MSVCRT.DLL" at base 76980000 "choice.exe" loaded module "KERNEL32.DLL" at base 777f000040:T423,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91" was detected as "Microsoft Visual C/C++" and name: "Compiler" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91" was detected as "Microsoft Linker" and name: "Linker" "Anymore.pif" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Anymore.pif" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Anymore.pif" was detected as "Microsoft Linker" and name: "Linker" "W" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "W" was detected as "Microsoft Visual C/C++" and name: "Compiler" "W" was detected as "Microsoft Linker" and name: "Linker" "Lbs" was detected as "Nullsoft Scriptable Install System" and name: "Installer" "Lbs" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Lbs" was detected as "Microsoft Linker" and name: "Linker"41:T19d2,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Games Explorer" (Path: "HKCU\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Sticky Notes Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{F3F5824C-AD58-4728-AF59-A1EBE3392799}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "tasklist.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "tasklist.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}") "tasklist.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS") "Anymore.pif" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "Anymore.pif" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "Anymore.pif" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "Anymore.pif" touched "Search Gatherer Notification" (Path: "HKCU\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\TREATAS") "Anymore.pif" touched "WBEM Scripting DateTime" (Path: "HKCU\CLSID\{47DFBE54-CF76-11D3-B38F-00105A1F473A}\TREATAS") "Anymore.pif" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Anymore.pif" touched "Namespace Walker" (Path: "HKCU\CLSID\{72EB61E0-8672-4303-9175-F2E4C68B2E7C}\TREATAS") "Anymore.pif" touched "Shell Copy Hook" (Path: "HKCU\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\INPROCSERVER32") "Anymore.pif" touched "Shell extensions for sharing" (Path: "HKCU\CLSID\{40DD6E20-7C17-11CE-A804-00AA003CA9F6}\INPROCSERVER32") "Anymore.pif" touched "Share Manager" (Path: "HKCU\CLSID\{EDB5F444-CB8D-445A-A523-EC5AB6EA33C7}\TREATAS") "Anymore.pif" touched "Inplace Share Engine" (Path: "HKCU\CLSID\{6311429E-2F1A-4777-880F-C7289FD10169}\TREATAS")42:Ta58,Process "cmd.exe" (UID: 00000000-00002304) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "cmd.exe" (UID: 00000000-00002304) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "tasklist.exe" (UID: 00000000-00003420) was launched with new environment variables: "Chest="X", Cornwall="0", Semiconductor="W", Ko="o", Smoke="d", Fbi="a", Algebra="g", Involve="4", Bristol="N", pGevffORGnSnWFQ="Anymore.pif", Clothing="k", Sporting="m", Conversion="z", Sizes="i", Observe="U", Object="9", Avoiding="3", Expenses="S", Baptist=".", PROMPT="$P$G", Adventures="O", Plant="I", Vpn="P", Advertiser="f", Banks="V", X="s", Dildo="6", Sugar="B", Streaming="Q", Rebate="8", Pharmaceutical="y", Marriott="/", Pig="w", Starring="p", Potentially="t", Enterprise="5", Transfers="C", Contribute="F", Hungarian="7"" Process "tasklist.exe" (UID: 00000000-00003776) was launched with new environment variables: "Ing="73376"" Process "Anymore.pif" (UID: 00000000-00006124) was launched with missing environment variables: "Chest, Cornwall, Semiconductor, Ko, Smoke, Fbi, Algebra, Involve, Bristol, pGevffORGnSnWFQ, Clothing, Sporting, Conversion, Sizes, Observe, Object, Avoiding, Ing, Expenses, Baptist, PROMPT, Adventures, Plant, Vpn, Advertiser, Banks, X, Dildo, Sugar, Streaming, Rebate, Pharmaceutical, Marriott, Pig, Starring, Potentially, Enterprise, Transfers, Contribute, Hungarian" Process "choice.exe" (UID: 00000000-00006112) was launched with new environment variables: "Chest="X", Cornwall="0", Semiconductor="W", Ko="o", Smoke="d", Fbi="a", Algebra="g", Involve="4", Bristol="N", pGevffORGnSnWFQ="Anymore.pif", Clothing="k", Sporting="m", Conversion="z", Sizes="i", Observe="U", Object="9", Avoiding="3", Ing="73376", Expenses="S", Baptist=".", PROMPT="$P$G", Adventures="O", Plant="I", Vpn="P", Advertiser="f", Banks="V", X="s", Dildo="6", Sugar="B", Streaming="Q", Rebate="8", Pharmaceutical="y", Marriott="/", Pig="w", Starring="p", Potentially="t", Enterprise="5", Transfers="C", Contribute="F", Hungarian="7"" Process "cmd.exe" (UID: 00000000-00004024) was launched with missing environment variables: "Chest, Cornwall, Semiconductor, Ko, Smoke, Fbi, Algebra, Involve, Bristol, pGevffORGnSnWFQ, Clothing, Sporting, Conversion, Sizes, Observe, Object, Avoiding, Ing, Expenses, Baptist, PROMPT, Adventures, Plant, Vpn, Advertiser, Banks, X, Dildo, Sugar, Streaming, Rebate, Pharmaceutical, Marriott, Pig, Starring, Potentially, Enterprise, Transfers, Contribute, Hungarian" Process "timeout.exe" (UID: 00000000-00003872) was launched with new environment variables: "PROMPT="$P$G""43:T54e,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "Anymore.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Anymore.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Anymore.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Anymore.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "Anymore.pif" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")44:T4d0,Spawned process "cmd.exe" with commandline "/k move Dvd Dvd.cmd & Dvd.cmd & exit" (UID: 00000000-00002304) Spawned process "tasklist.exe" (UID: 00000000-00003420) Spawned process "findstr.exe" with commandline "findstr /I "wrsa.exe opssvc.exe"" (UID: 00000000-00002768) Spawned process "tasklist.exe" (UID: 00000000-00003776) Spawned process "findstr.exe" with commandline "findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe ns ..." (UID: 00000000-00003568), Spawned process "cmd.exe" with commandline "cmd /c md 73376" (UID: 00000000-00002372), Spawned process "findstr.exe" with commandline "findstr /V "SNAPSHOTGENTLYFITNESSINCORPORATE" Confirmed" (UID: 00000000-00004360), Spawned process "cmd.exe" with commandline "cmd /c copy /b ..\\Lbs + ..\\Gifts + ..\\Pizza + ..\\Lane + ..\ ..." (UID: 00000000-00001400), Spawned process "Anymore.pif" with commandline "W" (UID: 00000000-00006124), Spawned process "choice.exe" with commandline "choice /d y /t 5" (UID: 00000000-00006112), Spawned process "cmd.exe" with commandline "/c timeout /t 10 & del /f /q "%TEMP%\\73376\\Anymore.pif" & rd / ..." (UID: 00000000-00004024), Spawned process "timeout.exe" with commandline "timeout /t 10" (UID: 00000000-00003872)45:T4d0,Spawned process "cmd.exe" with commandline "/k move Dvd Dvd.cmd & Dvd.cmd & exit" (UID: 00000000-00002304) Spawned process "tasklist.exe" (UID: 00000000-00003420) Spawned process "findstr.exe" with commandline "findstr /I "wrsa.exe opssvc.exe"" (UID: 00000000-00002768) Spawned process "tasklist.exe" (UID: 00000000-00003776) Spawned process "findstr.exe" with commandline "findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe ns ..." (UID: 00000000-00003568), Spawned process "cmd.exe" with commandline "cmd /c md 73376" (UID: 00000000-00002372), Spawned process "findstr.exe" with commandline "findstr /V "SNAPSHOTGENTLYFITNESSINCORPORATE" Confirmed" (UID: 00000000-00004360), Spawned process "cmd.exe" with commandline "cmd /c copy /b ..\\Lbs + ..\\Gifts + ..\\Pizza + ..\\Lane + ..\ ..." (UID: 00000000-00001400), Spawned process "Anymore.pif" with commandline "W" (UID: 00000000-00006124), Spawned process "choice.exe" with commandline "choice /d y /t 5" (UID: 00000000-00006112), Spawned process "cmd.exe" with commandline "/c timeout /t 10 & del /f /q "%TEMP%\\73376\\Anymore.pif" & rd / ..." (UID: 00000000-00004024), Spawned process "timeout.exe" with commandline "timeout /t 10" (UID: 00000000-00003872)46:T522,"Anymore.pif" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\73376\Anymore.pif]- [targetUID: 00000000-00002304] "Expressed" has type "data"- Location: [%TEMP%\Expressed]- [targetUID: 00000000-00002304] "W" has type "DOS executable (COM) start instruction 0x8c176568 237ba128"- Location: [%TEMP%\73376\W]- [targetUID: 00000000-00001400] "Lane" has type "data"- Location: [%TEMP%\Lane]- [targetUID: 00000000-00001400] "Tablets" has type "OpenPGP Secret Key"- Location: [%TEMP%\Tablets]- [targetUID: 00000000-00001400] "Pizza" has type "data"- Location: [%TEMP%\Pizza]- [targetUID: 00000000-00001400] "Lbs" has type "DOS executable (COM) start instruction 0x8c176568 237ba128"- Location: [%TEMP%\Lbs]- [targetUID: 00000000-00001400] "Gifts" has type "data"- Location: [%TEMP%\Gifts]- [targetUID: 00000000-00001400] "Terrain" has type "data"- Location: [%TEMP%\Terrain]- [targetUID: 00000000-00001400] "Dvd" has type "ASCII text with very long lines (816) with CRLF line terminators"- Location: [%TEMP%\Dvd]- [targetUID: 00000000-00002304] "Confirmed" has type "data"- Location: [%TEMP%\Confirmed]- [targetUID: 00000000-00004264] "8ZGFGEPA.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8ZGFGEPA.txt]- [targetUID: 00000000-00006124]47:Tbdd,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}\"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: ""; Value: "")48:T1399,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC3-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "DATA"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{DCBFAAC4-D863-11E7-B9FF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{031E4825-7B94-4DC3-B131-E946B44C8DD5}"; Key: "SUPPRESSIONPOLICY"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{04731B67-D933-450A-90E6-4ACD2E9408FE}"; Key: "SUPPRESSIONPOLICY"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"; Key: "SUPPRESSIONPOLICY"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}"; Key: "SUPPRESSIONPOLICY"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}"; Key: "SUPPRESSIONPOLICY"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "")49:Tb84,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe.Local\" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\COMCTL32.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\VERSION.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\system32\rpcss.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\CRYPTBASE.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\system32\CRYPTBASE.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "\Device\KsecDD" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\system32\uxtheme.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\SHFOLDER.DLL" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\system32\SHFOLDER.DLL" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\FLTLIB.DLL" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\MSVCP140.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll"4a:T537,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "Anymore.pif" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "Anymore.pif" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "Anymore.pif" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "Anymore.pif" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "Anymore.pif" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\8ZGFGEPA.txt" "Anymore.pif" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "Anymore.pif" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "Anymore.pif" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "Anymore.pif" touched file "%APPDATA%\Microsoft\Windows\Cookies" "Anymore.pif" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "Anymore.pif" touched file "%APPDATA%\Microsoft\Windows\Cookies\8ZGFGEPA.txt" "Anymore.pif" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"4b:Tdc5,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\VERSION.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\SHFOLDER.DLL" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\FLTLIB.DLL" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\MSVCP140.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\ucrtbase.DLL" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL"4c:T788,"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe.Local\" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\Mirc\" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\BottlesMemorialDigJanet" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BottlesMemorialDigJanet" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\Windows\system32\BottlesMemorialDigJanet" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\Windows\system\BottlesMemorialDigJanet" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\Windows\BottlesMemorialDigJanet" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\BottlesMemorialDigJanet" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\Windows\System32\Wbem\BottlesMemorialDigJanet" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\BottlesMemorialDigJanet" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\UrwInternetHelenOralSuspendedCentres" "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\UrwInternetHelenOralSuspendedCentres\"4d:T4b2,Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp")4e:Ted2,Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "InternetOpenUrlA" (Indicator: "InternetOpen"; Source: "00000000-00006124-00000C2C-257578096") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00006124-00000C2C-257578128") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00006124-00000C2C-257578191") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00006124-00000C2C-257578220") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00006124-00000C2C-257578250") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00006124-00000C2C-257578344") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00006124-00000C2C-261216975") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00006124-00000C2C-261217278") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000003.80595.008B0000.00000002.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00006124.00000003.80595.008B0000.00000002.mdmp")4f:T56d,Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "gethostname" (Indicator: "gethostname"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00006124.00000000.75684.01110000.00000002.mdmp, 00000000-00006124.00000001.77606.01110000.00000002.mdmp, 00000000-00006124.00000002.79528.01110000.00000002.mdmp")50:T16b5,Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00004264.00000000.74831.00408000.00000002.mdmp") Found URL "http://www.autoitscript.com/autoit3/filed" - Source: "00000000-00004264.00000000.74838.0041E000.00000004.mdmp") Found URL "http://ocsp2.globalsign.com/rootr306/0-0+%http://crl.globalsign.com/root-r3.crl0c\0z0_0402&https://www.globalsign.com/repository/0jee-mih?" - Source: "00000000-00004264.00000000.74838.0041E000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08,http://ocsp2.globalsign.com/gscodesignsha2g30vo0m0a20402&https://www.globalsign.com/repository/080604.http://crl.globalsign.com/gscodesignsha2g3.crl00j0z1globalsign" - Source: "00000000-00004264.00000000.74838.0041E000.00000004.mdmp") Found URL "https://www.autoitscript.com/autoit3/" - Source: "00000000-00004264.00000000.74838.0041E000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/0" - Source: "00000000-00004264.00000000.74838.0041E000.00000004.mdmp") Found URL "http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0\" (Indicator: \"base64\"; Source: \"00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp\")\n Found string \"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256\" (Indicator: \"aes\"; Source: \"00000000-00006124.00000003.80595.00DF0000.00000004.mdmp\")\n Found string \"moc.hcraeserdracerocs\" (Indicator: \"aes\"; Source: \"00000000-00006124.00000003.80595.00DF0000.00000004.mdmp\")\n Found string \"ten.mrofdaes\" (Indicator: \"aes\"; Source: \"00000000-00006124.00000003.80595.00DF0000.00000004.mdmp\")\n Found string \"ten.mrofdaes.revres\" (Indicator: \"aes\"; Source: \"00000000-00006124.00000003.80595.00DF0000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00006124.00000003.80595.00DF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"%WINDIR%\\system32\\tasklist.exe\" [Source: 00000000-00002304-00000C47-11143615622]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Found reference to API \"GetCurrentHwProfileA\" (Indicator: \"GetCurrentHwProfile\"; Source: \"00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; File: \"00000000-00006124.00000003.80595.00821000.00000020.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"Found string \"findstr /I \"wrsa.exe opssvc.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00002304-00000C47-12394901988\")\n Found string \"findstr /I \"avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe\"\" (Indicator: \"findstr \"; Source: \"00000000-00002304-00000C47-16335471182\")\n Found string \"findstr /V \"SNAPSHOTGENTLYFITNESSINCORPORATE\" Confirmed\" (Indicator: \"findstr \"; Source: \"00000000-00002304-00000C47-20302689314\")","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"passwords.txt\" (Indicator: \"password\"; Source: \"00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"HostName\" (Indicator: \"hostname\"; Source: \"00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp\")\n Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Anymore.pif\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * From Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp\")\n Found string \"Select * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.00DF0000.00000004.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Searches for patterns in files","description":"Process \"findstr.exe\" with commandline \"findstr /I \"wrsa.exe opssvc.exe\"\" (UID: 00000000-00002768)\n Process \"findstr.exe\" with commandline \"findstr /I \"avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe\"\" (UID: 00000000-00003568)\n Process \"findstr.exe\" with commandline \"findstr /V \"SNAPSHOTGENTLYFITNESSINCORPORATE\" Confirmed\" (UID: 00000000-00004360)","origin":"Monitored Target","mitre_attack_id":"T1083","relevance":3,"id":"target-244","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinW\" (File: \"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91\")\n Found string \"SHEmptyRecycleBinW\" (Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Adjusts debug privileges","description":"\"tasklist.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"tasklist.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\" (UID: 00000000-00003420), \"tasklist.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\" (UID: 00000000-00003776)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$54","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; File: \"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00006124.00000003.80595.008B0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00006124.00000003.80595.008B0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00006124.00000003.80595.00DF0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Anymore.pif\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"Anymore.pif\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"References security-related Windows services","description":"\"findstr /I \"avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe\"\" (Indicator: \"wscsvc\") in Source: 00000000-00002304-00000C47-16335471182","origin":"File/Memory","mitre_attack_id":"T1574.010","relevance":3,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"www.credit-agricole.fr\" (Source: 00000000-00006124.00000003.80595.00DF0000.00000004.mdmp, Indicator: \"credit-agricole.fr\")\n \"capitalone.com\" (Source: 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp, Indicator: \"capitalone.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops PE files with misleading file extensions","description":"\"Anymore.pif\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\73376\\Anymore.pif]- [targetUID: 00000000-00002304]\n \"W\" has type \"DOS executable (COM) start instruction 0x8c176568 237ba128\"- Location: [%TEMP%\\73376\\W]- [targetUID: 00000000-00001400]\n \"Lbs\" has type \"DOS executable (COM) start instruction 0x8c176568 237ba128\"- Location: [%TEMP%\\Lbs]- [targetUID: 00000000-00001400]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops binary executable file with an unexpected extension","description":"\"Anymore.pif\" has unusual extension","origin":"Binary File","mitre_attack_id":"T1036.008","relevance":3,"id":"binary-75","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Anymore.pif\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\"- Location: [%TEMP%\\73376\\Anymore.pif]- [targetUID: 00000000-00002304]\n \"W\" has type \"DOS executable (COM) start instruction 0x8c176568 237ba128\"- Location: [%TEMP%\\73376\\W]- [targetUID: 00000000-00001400]\n \"Lbs\" has type \"DOS executable (COM) start instruction 0x8c176568 237ba128\"- Location: [%TEMP%\\Lbs]- [targetUID: 00000000-00001400]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files with unusual extensions","description":"\"Anymore.pif\" has type \"PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections\" and unusual extension \"pif\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":10,"id":"binary-17","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"Lane has high entropy\"\n \"Pizza has high entropy\"\n \"Gifts has high entropy\"\n \"Terrain has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"8ZGFGEPA.txt\" - Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\8ZGFGEPA.txt]- [targetUID: 00000000-00006124]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"SHAutoComplete\" (Source: 7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91, API is part of module: SHLWAPI.DLL)\n Found string \"GetUserDefaultUILanguage\" (Source: 7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91, API is part of module: KERNELBASE.DLL)\n Found string \"RegDeleteKeyExW\" (Source: 7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91, API is part of module: ADVAPI32.DLL)\n Found string \"MoveFileExW\" (Source: 7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91, API is part of module: KERNEL32.DLL)\n Found string \"Module32NextW\" (Source: 7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91, API is part of module: KERNEL32.DLL)\n Found string \"Module32FirstW\" (Source: 7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91, API is part of module: KERNEL32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Anymore.pif\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.DLL at 00000000-00006124-49830-1882-008945D5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1562.001","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/26 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.DLL at 00000000-00006124-49830-757-00889ED8\n FindResourceW@KERNEL32.DLL at 00000000-00006124-49830-1573-0088443D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"Anymore.pif\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.99 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"Anymore.pif\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to empty the Recycle Bin on the specified drive","description":"SHEmptyRecycleBinW@SHELL32.DLL at 00000000-00006124-49830-1680-0088DB6F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":3,"id":"stream-114","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00004264-47671-61-004053F8\n SystemParametersInfoW@USER32.DLL at 00000000-00006124-49830-858-00822BA9\n SystemParametersInfoW@USER32.DLL at 00000000-00006124-49830-1193-00835F00\n SystemParametersInfoW@USER32.DLL at 00000000-00006124-49830-1194-00835F8B\n SystemParametersInfoW@USER32.DLL at 00000000-00006124-49830-1933-00897B95","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.00DF0000.00000004.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsrC14B.tmp\" for deletion\n \"Anymore.pif\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\73376\\W\" for deletion\n \"cmd.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\73376\\Anymore.pif\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsrC14B.tmp\" with delete access\n \"cmd.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Dvd\" with delete access\n \"Anymore.pif\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\73376\\W\" with delete access\n \"cmd.exe\" opened \"C:\\ProgramData\\GCAEHDBAAECB\" with delete access\n \"cmd.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\73376\\Anymore.pif\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$58","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"Anymore.pif\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\system32\\cmd.exe\" /c timeout /t 10 & del /f /q \"%TEMP%\\73376\\Anymore.pif\" & rd /s /q \"C:\\\" - (UID: 00000000-00006124)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00003420)\n Process \"tasklist.exe\" with commandline \"\" (UID: 00000000-00003776)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe\" called \"ShellExecuteW\" with parameter cmd (UID: 00000000-00004264)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Steals sensitive data from browsers","description":"Found string \"SELECT target_path, tab_url from downloads\"; Source: \"00000000-00006124.00000002.79528.02CD0000.00000004.mdmp, 00000000-00006124.00000002.79528.02ED1000.00000040.mdmp, 00000000-00006124.00000003.80595.02CD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":10,"id":"string-508","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"malicious","category":"System Destruction","name":"Executes file deletion commands for data destruction","description":"[Recursive deletion on critical path] Process \"cmd.exe\" with commandline \"/c timeout /t 10 & del /f /q \"%TEMP%\\\\73376\\\\Anymore.pif\" & rd /s /q \"%ALLUSERSPROFILE%\\\\GCAEHDBAAECB\" & exit\" (UID: 00000000-00004024)","origin":"Monitored Target","mitre_attack_id":"T1485","relevance":3,"id":"target-9003","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$59","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Spyware","details_count":6,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Contains ability to read clipboard data"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"},{"detail":"Tries to gather information about running processes on a system"}],"sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"},{"detail":"Attempts to search for AV-related strings in a file"}],"sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]}],"intel_graph":{"map":{"Domain:CiFcFqtXYurn.CiFcFqtXYurn":{"type":"Domain","value":"CiFcFqtXYurn.CiFcFqtXYurn"},"Domain:t.me":{"type":"Domain","value":"t.me"},"File:07fb69de0244636794c18a27a8d9ba35abf506fb2a1a15638b5014a15b07d5ce":{"type":"File","value":"07fb69de0244636794c18a27a8d9ba35abf506fb2a1a15638b5014a15b07d5ce"},"File:136ad0d2265925bed6bff9ef5b821e0b789166ab857bfc0c643d4fb11dd13c6d":{"type":"File","value":"136ad0d2265925bed6bff9ef5b821e0b789166ab857bfc0c643d4fb11dd13c6d"},"File:237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d":{"type":"File","value":"237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d"},"File:4285e946748334962755dfcd75aa8cad8078b7a4477864b8b7c5071d2101b0e9":{"type":"File","value":"4285e946748334962755dfcd75aa8cad8078b7a4477864b8b7c5071d2101b0e9"},"File:4ded4b4629dfbfa9cad8ee62d11171a47629ccbc1a5c9471299f0e285012cfc8":{"type":"File","value":"4ded4b4629dfbfa9cad8ee62d11171a47629ccbc1a5c9471299f0e285012cfc8"},"File:563f8caaaeb7be91d9efc7d57aef6a55fcf66af30b9aeff57561e572fdf0fe11":{"type":"File","value":"563f8caaaeb7be91d9efc7d57aef6a55fcf66af30b9aeff57561e572fdf0fe11"},"File:65e055a8fa561c88a567255e6ea7c2dd3a2a7376a953437ed2e34c9e3e0fdc51":{"type":"File","value":"65e055a8fa561c88a567255e6ea7c2dd3a2a7376a953437ed2e34c9e3e0fdc51"},"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91":{"type":"File","value":"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat VidarStealer"]}},"File:a59da2c2b5afba26b0e3066cd464dd40080ac9061353eaeff92eee8b27a844c5":{"type":"File","value":"a59da2c2b5afba26b0e3066cd464dd40080ac9061353eaeff92eee8b27a844c5"},"File:b7d284c14be76abafce77fea1ceb124471483f6675414318a28d81bc2da05aa0":{"type":"File","value":"b7d284c14be76abafce77fea1ceb124471483f6675414318a28d81bc2da05aa0"},"File:c73d8f1fbe4bbcced2c33a4fb8c40758ca76ca528e7ade4e69d62b474ad562a2":{"type":"File","value":"c73d8f1fbe4bbcced2c33a4fb8c40758ca76ca528e7ade4e69d62b474ad562a2"},"File:e191e7de04d0ee4a3b882fb058dc1693b93c5fd412846934b08fb680552412db":{"type":"File","value":"e191e7de04d0ee4a3b882fb058dc1693b93c5fd412846934b08fb680552412db"},"File:fb113a53ad9d7cf9004be7c488743471379f193ffb071ab438b7ad6e29b1df92":{"type":"File","value":"fb113a53ad9d7cf9004be7c488743471379f193ffb071ab438b7ad6e29b1df92"},"Ip:149.154.167.99":{"type":"Ip","value":"149.154.167.99"},"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21":{"type":"Threat","value":"VidarStealer","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1544685498232241108","root":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat VidarStealer"]}},{"id":"1544685498232241107","root":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"Threat:81f5272cf61469dac849b8f800732474f5623d29bb49baba6056f04ff9872c21"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","edges":[{"edge_kind":"contacted_ip","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"Ip:149.154.167.99"},{"edge_kind":"contacted_domain","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"Domain:CiFcFqtXYurn.CiFcFqtXYurn"},{"edge_kind":"contacted_domain","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"Domain:t.me"},{"edge_kind":"resolves_to","from_key":"Domain:t.me","to_key":"Ip:149.154.167.99"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","edges":[{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:a59da2c2b5afba26b0e3066cd464dd40080ac9061353eaeff92eee8b27a844c5"},{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d"},{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:e191e7de04d0ee4a3b882fb058dc1693b93c5fd412846934b08fb680552412db"},{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:563f8caaaeb7be91d9efc7d57aef6a55fcf66af30b9aeff57561e572fdf0fe11"},{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:65e055a8fa561c88a567255e6ea7c2dd3a2a7376a953437ed2e34c9e3e0fdc51"},{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:136ad0d2265925bed6bff9ef5b821e0b789166ab857bfc0c643d4fb11dd13c6d"},{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:07fb69de0244636794c18a27a8d9ba35abf506fb2a1a15638b5014a15b07d5ce"},{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:b7d284c14be76abafce77fea1ceb124471483f6675414318a28d81bc2da05aa0"},{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:fb113a53ad9d7cf9004be7c488743471379f193ffb071ab438b7ad6e29b1df92"},{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:c73d8f1fbe4bbcced2c33a4fb8c40758ca76ca528e7ade4e69d62b474ad562a2"},{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:4ded4b4629dfbfa9cad8ee62d11171a47629ccbc1a5c9471299f0e285012cfc8"},{"edge_kind":"extracted","from_key":"File:7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","to_key":"File:4285e946748334962755dfcd75aa8cad8078b7a4477864b8b7c5071d2101b0e9"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":133,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":23,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a981674bfd4e87f36077ed5","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["NLD"],"submit_name":"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","analysis_start_time":"2026-09-02T12:28:39+00:00","indicators_count":{"informative":268,"suspicious":88,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]}],"dns_resolutions":[{"domain":"CiFcFqtXYurn.CiFcFqtXYurn","ttl":86388,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"domain":"t.me","address":"149.154.167.99","ttl":14,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}],"processes":[{"pid":4264,"ppid":0,"name":"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe","command_line":"","sha256":"7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91","normalized_path":"C:\\7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91.exe","uid":"00000000-00004264","icon":"$5a"},{"pid":2304,"ppid":4264,"name":"cmd.exe","command_line":"/k move Dvd Dvd.cmd & Dvd.cmd & exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00000000-00004264","uid":"00000000-00002304"},{"pid":3420,"ppid":2304,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00002304","uid":"00000000-00003420"},{"pid":2768,"ppid":2304,"name":"findstr.exe","command_line":"findstr /I \"wrsa.exe opssvc.exe\"","sha256":"28feb2fec791ef44cf24a61c4bf175b00dba030b53ab1b5b36aed898a2f5cf37","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00002304","uid":"00000000-00002768"},{"pid":3776,"ppid":2304,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00002304","uid":"00000000-00003776"},{"pid":3568,"ppid":2304,"name":"findstr.exe","command_line":"findstr /I \"avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe\"","sha256":"28feb2fec791ef44cf24a61c4bf175b00dba030b53ab1b5b36aed898a2f5cf37","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00002304","uid":"00000000-00003568"},{"pid":2372,"ppid":2304,"name":"cmd.exe","command_line":"cmd /c md 73376","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002304","uid":"00000000-00002372"},{"pid":4360,"ppid":2304,"name":"findstr.exe","command_line":"findstr /V \"SNAPSHOTGENTLYFITNESSINCORPORATE\" Confirmed","sha256":"28feb2fec791ef44cf24a61c4bf175b00dba030b53ab1b5b36aed898a2f5cf37","normalized_path":"%WINDIR%\\system32\\findstr.exe","parent_uid":"00000000-00002304","uid":"00000000-00004360"},{"pid":1400,"ppid":2304,"name":"cmd.exe","command_line":"cmd /c copy /b ..\\Lbs + ..\\Gifts + ..\\Pizza + ..\\Lane + ..\\Tablets + ..\\Terrain W","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002304","uid":"00000000-00001400"},{"pid":6124,"ppid":2304,"name":"Anymore.pif","command_line":"W","sha256":"237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d","normalized_path":"%TEMP%\\73376\\Anymore.pif","parent_uid":"00000000-00002304","uid":"00000000-00006124"},{"pid":4024,"ppid":6124,"name":"cmd.exe","command_line":"/c timeout /t 10 & del /f /q \"%TEMP%\\73376\\Anymore.pif\" & rd /s /q \"%ALLUSERSPROFILE%\\GCAEHDBAAECB\" & exit","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00006124","uid":"00000000-00004024"},{"pid":3872,"ppid":4024,"name":"timeout.exe","command_line":"timeout /t 10","sha256":"c4efafc49d46dba7e89cd94892799c739a3103f724fec9be494bf1267fdb059e","normalized_path":"%WINDIR%\\system32\\timeout.exe","parent_uid":"00000000-00004024","uid":"00000000-00003872"},{"pid":6112,"ppid":2304,"name":"choice.exe","command_line":"choice /d y /t 5","sha256":"4108605207ef00fcbbfe7ed7c3f96300601fb79f913d0e290538e8e02082cacc","normalized_path":"%WINDIR%\\system32\\choice.exe","parent_uid":"00000000-00002304","uid":"00000000-00006112"}],"all_imported_dlls":["imm32.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-locale-l1-1-0.dll","mswsock.dll","cfgmgr32.dll","slc.dll","devobj.dll","dwmapi.dll","GdiPlus.dll","cscapi.dll","ws2_32.dll","tzres.dll","msasn1.dll","lpk.dll","msvcrt.dll","winmm.dll","winnsi.dll","NapiNSP.dll","WSHTCPIP.DLL","kernel32.dll","vcruntime140.dll","ntmarta.dll","framedynos.dll","samcli.dll","nlaapi.dll","schannel.dll","user32.dll","shell32.dll","normaliz.dll","usp10.dll","Wldap32.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","RpcRtRemote.dll","ntdsapi.dll","crypt32.dll","FWPUCLNT.DLL","npmproxy.dll","comctl32.dll","VxSSL32.dll","nsi.dll","api-ms-win-crt-filesystem-l1-1-0.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","msvcp140.dll","api-ms-win-crt-math-l1-1-0.dll","iertutil.dll","dbghelp.dll","sechost.dll","fltLib.dll","api-ms-win-crt-heap-l1-1-0.dll","clbcatq.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wsock32.dll","RstrtMgr.dll","credssp.dll","msctf.dll","shfolder.dll","api-ms-win-core-processthreads-l1-1-1.dll","dhcpcsvc6.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-environment-l1-1-0.dll","rsaenh.dll","dnsapi.dll","api-ms-win-crt-stdio-l1-1-0.dll","srvcli.dll","wbemsvc.dll","fastprox.dll","psapi.dll","dhcpcsvc.dll","wbemcomn.dll","sspicli.dll","pnrpnsp.dll","ncrypt.dll","wship6.dll","advapi32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","IPHLPAPI.DLL","winrnr.dll","winsta.dll","netprofm.dll","wbemdisp.dll","ntshrui.dll","version.dll","api-ms-win-core-file-l2-1-0.dll","apphelp.dll","mpr.dll","wkscli.dll","urlmon.dll","netapi32.dll","winhttp.dll","gdi32.dll","ieframe.dll","winbrand.dll","wintrust.dll","propsys.dll","webio.dll","wshqos.dll","bcryptprimitives.dll","profapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","wbemprox.dll","wmiutils.dll","oleaut32.dll","setupapi.dll","netutils.dll","cryptsp.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","bcrypt.dll","comdlg32.dll","KernelBase.dll","shlwapi.dll","rpcrt4.dll","ucrtbase.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wininet.dll","cryptbase.dll","uxtheme.dll","api-ms-win-core-timezone-l1-1-0.dll","rasadhlp.dll","ntdll.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-utility-l1-1-0.dll","wbemcomn2.dll","gpapi.dll","ole32.dll","rpcss.dll","userenv.dll","api-ms-win-crt-string-l1-1-0.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"W","sha256":"a59da2c2b5afba26b0e3066cd464dd40080ac9061353eaeff92eee8b27a844c5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Anymore.pif","sha256":"237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Lbs","sha256":"e191e7de04d0ee4a3b882fb058dc1693b93c5fd412846934b08fb680552412db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Confirmed","sha256":"563f8caaaeb7be91d9efc7d57aef6a55fcf66af30b9aeff57561e572fdf0fe11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Dvd","sha256":"65e055a8fa561c88a567255e6ea7c2dd3a2a7376a953437ed2e34c9e3e0fdc51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Gifts","sha256":"136ad0d2265925bed6bff9ef5b821e0b789166ab857bfc0c643d4fb11dd13c6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Lane","sha256":"07fb69de0244636794c18a27a8d9ba35abf506fb2a1a15638b5014a15b07d5ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Pizza","sha256":"b7d284c14be76abafce77fea1ceb124471483f6675414318a28d81bc2da05aa0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Tablets","sha256":"fb113a53ad9d7cf9004be7c488743471379f193ffb071ab438b7ad6e29b1df92","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Terrain","sha256":"c73d8f1fbe4bbcced2c33a4fb8c40758ca76ca528e7ade4e69d62b474ad562a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"8ZGFGEPA.txt","sha256":"4ded4b4629dfbfa9cad8ee62d11171a47629ccbc1a5c9471299f0e285012cfc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"Expressed","sha256":"4285e946748334962755dfcd75aa8cad8078b7a4477864b8b7c5071d2101b0e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%TEMP%\\nsrC14B.tmp","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%TEMP%\\Confirmed","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%TEMP%\\Pizza","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%TEMP%\\Tablets","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%TEMP%\\Lane","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%TEMP%\\Gifts","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%TEMP%\\Terrain","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%TEMP%\\Lbs","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%TEMP%\\Dvd","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%TEMP%\\Expressed","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%TEMP%\\73376\\W","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8ZGFGEPA.txt","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a981674bfd4e87f36077ed5"}]}]}},"report_ids":{"sandbox_job_ids":["6a981674bfd4e87f36077ed5"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 7e74f3e8d070… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7e74f3e8d070…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 7e74f3e8d070… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7e74f3e8d070…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 7e74f3e8d070… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7e74f3e8d070…. Malware family: Trojan.Generic. Threat score 100/100. 10/27 AV engines flagged this file. 8 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5b","11",{}]]