INetSim default HTML page

34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 84:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T420,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 9616cb50bfce… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9616cb50bfce…. Threat score 100/100. 0/0 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79"],"about":{"@type":"SoftwareApplication","name":"linuxwin_trial.msi","applicationCategory":["msi","data"],"identifier":"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":9,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T7ad,"msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")37:T86d,"msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "msiexec.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")38:Ta76,"msiexec.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder" (Filter: 4; Subtree: 131072) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Root" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 5; Subtree: 2733313) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Policies\Microsoft\SystemCertificates" (Filter: 5; Subtree: 513) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 5; Subtree: 1) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 5; Subtree: 2733825) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 2513153) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 5; Subtree: 2733825) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 5; Subtree: 2733825) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 5; Subtree: 769) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 5; Subtree: 2733825) "msiexec.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 2510337) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 5; Subtree: 2733825) "msiexec.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople" (Filter: 5; Subtree: 2733825)39:T552,"msiexec.exe" touched file "C:\Windows\System32\en-US\msiexec.exe.mui" "msiexec.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "msiexec.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "msiexec.exe" touched file "C:\Windows\System32\en-US\winhttp.dll.mui" "msiexec.exe" touched file "C:\Windows\System32\sxs.dll" "msiexec.exe" touched file "C:\Windows\system32\ar-SA\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\bg-BG\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\cs-CZ\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\da-DK\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\de-DE\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\el-GR\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\en\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\es-ES\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\et-EE\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\fi-FI\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\fr-FR\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\he-IL\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\hr-HR\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\hu-HU\sxs.DLL.mui" "msiexec.exe" touched file "C:\Windows\system32\it-IT\sxs.DLL.mui"3a:T63c,Heuristic match: "activator.de.lang.mo" Heuristic match: "activator.de.wxLang.mo" Heuristic match: "activator.en.lang.mo" Heuristic match: "activator.es.lang.mo" Heuristic match: "activator.es.wxLang.mo" Heuristic match: "activator.fr.lang.mo" Heuristic match: "activator.fr.wxLang.mo" Heuristic match: "activator.it.lang.mo" Heuristic match: "activator.it.wxLang.mo" Heuristic match: "activator.ru.lang.mo" Heuristic match: "activator.ru.wxLang.mo" Heuristic match: "activator.zh.lang.mo" Heuristic match: "t3;{(r.Ph" Pattern match: "http://www.microsoft.com/whdc/ddk/debugging/" Pattern match: "http://www.wxwidgets.org" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" Pattern match: "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVN" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab" Pattern match: "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEALOu8nnNSKOQdu" Pattern match: "https://about.twitter.com/resources/buttons" Pattern match: "https://my.paragon-software.com" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "http://www.microsoft.com/windows0"3b:T5fa,"msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\VSS\DIAG") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SPP") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SYSTEMRESTORE") "msiexec.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SYSTEMRESTORE"; Key: "SRCREATERP (ENTER)"; Value: "4800000000000000D870EC9FB4F7D60188060000C80F0000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"), "msiexec.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SPP"; Key: "SPPCREATE (ENTER)"; Value: "4800000000000000D870EC9FB4F7D60188060000C80F0000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"), "msiexec.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SPP"; Key: "SPPCREATE (LEAVE)"; Value: "4800000000000000789612A0B4F7D60188060000C80F0000D00700000100000000000000022304800000000000000000000000000000000000000000000000000000000000000000"), "msiexec.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VSS\DIAG\SYSTEMRESTORE"; Key: "SRCREATERP (LEAVE)"; Value: "4800000000000000789612A0B4F7D60188060000C80F0000D50700000100000000000000022304800000000000000000000000000000000000000000000000000000000000000000")3c:T8c5,"msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "msiexec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")3d:T902,"msiexec.exe" wrote bytes "00100000" to virtual address "0xFD6085A4" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "00100000" to virtual address "0xFD608468" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "40135ffdfe070000" to virtual address "0xFD60FE48" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "40135ffdfe070000" to virtual address "0xFD60FB48" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "3012ecf5fe070000" to virtual address "0xF95B2050" (part of module "WEBIO.DLL") "msiexec.exe" wrote bytes "40135ffdfe070000" to virtual address "0xFD60FE10" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "00105ffdfe070000" to virtual address "0xFD60FE50" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "40135ffdfe070000" to virtual address "0xFD60FB10" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "00105ffdfe070000" to virtual address "0xFD60FB50" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "00100000" to virtual address "0xFFBC1748" (part of module "WS2_32.DLL") "msiexec.exe" wrote bytes "40130000" to virtual address "0xFD608538" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "40130000" to virtual address "0xFD608478" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "00105ffdfe070000" to virtual address "0xFD60FE18" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "00105ffdfe070000" to virtual address "0xFD60FB18" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "48b8e011ecf5fe070000ffe0" to virtual address "0xFFB91000" (part of module "WS2_32.DLL") "msiexec.exe" wrote bytes "48b81016ecf5fe070000ffe0" to virtual address "0xFD5F1000" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "48b86013ecf5fe070000ffe0" to virtual address "0xFD5F1340" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "b4365d75" to virtual address "0x755E025C" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "d83a5d75" to virtual address "0x755E01FC" (part of module "SSPICLI.DLL") "msiexec.exe" wrote bytes "c0dfd3771cf9d277ccf8d2770d64d47700000000c0114f7600000000fc3e4f7600000000e0134f760000000094571f7725e0d377c6e0d37700000000bc6a1e7700000000cf314f760000000093191f77000000002c324f7600000000" to virtual address "0x76C31000" (part of module "NSI.DLL")3e:T542,"msiexec.exe" called "LoadResource with parameter {'hModule': '459800578', 'hResInfo': '459867664'}" (UID: 00000000-00006356) "msiexec.exe" called "LoadResource with parameter {'hModule': '526843905', 'hResInfo': '527500504'}" (UID: 00000000-00006356) "msiexec.exe" called "LoadResource with parameter {'hModule': '526909441', 'hResInfo': '526999112'}" (UID: 00000000-00006356) "msiexec.exe" called "LoadResource with parameter {'hModule': '526909441', 'hResInfo': '527566040'}" (UID: 00000000-00006356) "msiexec.exe" called "LoadResource with parameter {'hModule': '527761409', 'hResInfo': '528286936'}" (UID: 00000000-00006356) "msiexec.exe" called "LoadResource with parameter {'hModule': '527761409', 'hResInfo': '527766856'}" (UID: 00000000-00006356) "msiexec.exe" called "LoadResource with parameter " (UID: 00000000-00006356) "msiexec.exe" called "LoadResource with parameter {'hModule': '529334273', 'hResInfo': '532566352'}" (UID: 00000000-00006356) "msiexec.exe" called "LoadResource with parameter {'hModule': '529334273', 'hResInfo': '532539728'}" (UID: 00000000-00006356) "msiexec.exe" called "LoadResource with parameter {'hModule': '527761409', 'hResInfo': '528001096'}" (UID: 00000000-00006356) "msiexec.exe" called "LoadResource with parameter {'hModule': '527761409', 'hResInfo': '528173640'}" (UID: 00000000-00006356)3f:T428,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")40:T810,Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcessToken"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcessToken"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThreadToken"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "SetThreadToken" (Indicator: "SetThreadToken"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")41:T7bc,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")42:Taf8,Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")43:T104b,Contains long base64 encoded string "errorFlsAllocFlsFreeFlsGetValueFlsSetValueInitializeCriticalSectionExInitOnceExecuteOnceCreateEventExWCreateSemaphoreWCreateSemaphoreExWCreateThreadpoolTimerSetThreadpoolTimerWaitForThreadpoolTimerCallbacksCloseThreadpoolTimerCreateThreadpoolWaitSetThreadpoolWaitCloseThreadpoolWaitFlushProcessWriteBuffersFreeLibraryWhenCallbackReturnsGetCurrentProcessorNumberCreateSymbolicLinkWGetCurrentPackageIdGetTickCount64GetFileInformationByHandleExSetFileInformationByHandleGetSystemTimePreciseAsFileTimeInitializeConditionVariableWakeConditionVariableWakeAllConditionVariableSleepConditionVariableCSInitializeSRWLockAcquireSRWLockExclusiveTryAcquireSRWLockExclusiveReleaseSRWLockExclusiveSleepConditionVariableSRWCreateThreadpoolWorkSubmitThreadpoolWorkCloseThreadpoolWorkCompareStringExGetLocaleInfoExLCMapStringEx0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyzbad" in [Source : extmounter.exe] Contains long base64 encoded string "errorFlsAllocFlsFreeFlsGetValueFlsSetValueInitializeCriticalSectionExInitOnceExecuteOnceCreateEventExWCreateSemaphoreWCreateSemaphoreExWCreateThreadpoolTimerSetThreadpoolTimerWaitForThreadpoolTimerCallbacksCloseThreadpoolTimerCreateThreadpoolWaitSetThreadpoolWaitCloseThreadpoolWaitFlushProcessWriteBuffersFreeLibraryWhenCallbackReturnsGetCurrentProcessorNumberCreateSymbolicLinkWGetCurrentPackageIdGetTickCount64GetFileInformationByHandleExSetFileInformationByHandleGetSystemTimePreciseAsFileTimeInitializeConditionVariableWakeConditionVariableWakeAllConditionVariableSleepConditionVariableCSInitializeSRWLockAcquireSRWLockExclusiveTryAcquireSRWLockExclusiveReleaseSRWLockExclusiveSleepConditionVariableSRWCreateThreadpoolWorkSubmitThreadpoolWorkCloseThreadpoolWorkCompareStringExGetLocaleInfoExLCMapStringEx0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyzbad" in [Source : MSIDF42.tmp] Contains long base64 encoded string "dllSizeofResourceLockResourceLoadResourceFindResourceWFindResourceExWDisableThreadLibraryCallsVirtualProtectSleepGetVersionExWOutputDebugStringWIsDebuggerPresentGetCurrentProcessIdRaiseExceptionOutputDebugStringAHeapReAllocHeapAllocHeapFreeGetProcessHeapGetSystemTimeAsFileTimeGetTickCountEnterCriticalSectionLeaveCriticalSectionInitializeCriticalSectionDeleteCriticalSectionGetVersionExAHeapDestroyHeapSizeQueryPerformanceCounterGetCurrentThreadIdTerminateProcessGetCurrentProcessUnhandledExceptionFilterSetUnhandledExceptionFilterKERNEL32" in [Source : MSI986.tmp] Contains long base64 encoded string "handlerSeTokenObjectTypeFsRtlNotifyCleanupCcUninitializeCacheMapCcPurgeCacheSectionCcFlushCacheRtlLengthSecurityDescriptorKeInitializeEventKeEnterCriticalRegionKeLeaveCriticalRegionExAllocatePoolWithTagExFreePoolWithTagExInitializeResourceLiteExAcquireResourceExclusiveLiteExReleaseResourceLiteExDeleteResourceLiteSeAssignSecuritySeDeassignSecurityIofCompleteRequestIoGetFileObjectGenericMappingFsRtlInitializeOplockFsRtlUninitializeOplockFsRtlTeardownPerStreamContextsMmMapLockedPagesSpecifyCacheFsRtlNotifyFullChangeDirectoryIoGetTopLevelIrpIoSetTopLevelIrpRtlInitUnicodeStringExInitializeNPagedLookasideListExDeleteNPagedLookasideListMmProbeAndLockPagesMmUnlockPagesIoAllocateMdlIoDeleteDeviceIoDeleteSymbolicLinkIoFreeMdlFsRtlRegisterFileSystemFilterCallbacksFsRtlCopyReadFsRtlCopyWriteFsRtlMdlReadDevFsRtlMdlReadCompleteDevFsRtlPrepareMdlWriteDevFsRtlMdlWriteCompleteDevFsRtlNotifyFullReportChangeRtlFreeUnicodeStringRtlStringFromGUIDKeClearEventKeSetEventExQueryDepthSListExpInterlockedPopEntrySListExpInterlockedPushEntrySListIoReleaseCancelSpinLockDbgPrintFsRtlIsNtstatusExpectedMmFlushImageSectionMmCanFileBeTruncatedKeWaitForSingleObjectKeInitializeSpinLockPsCreateSystemThreadPsTerminateSystemThreadIoCreateDeviceIoCreateSymbolicLinkObReferenceObjectByHandleObfReferenceObjectObfDereferenceObjectTZwCloseFsRtlNotifyInitializeSyncFsRtlRegisterUncProviderFsRtlDeregisterUncProviderKeResetEventKeWaitForMultipleObjectsExInterlockedInsertTailListIoAllocateWorkItemIoQueueWorkItemIoGetRequestorProcessIdKeInitializeTimerExKeCancelTimerKeSetTimerExKeQueryTimeIncrementExAcquireResourceSharedLite" in [Source : SET3D7.tmp]44:T580,"msiexec.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pcchString": "73000000"} "msiexec.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pcchString": "73000000"} "msiexec.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pszString": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg=" "pcchString": "72000000"} "msiexec.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pszString": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg=" "pcchString": "72000000"} "msiexec.exe" called "CryptBinaryToStringA" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pszString": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEALOu8nnNSKOQduubPzIods=" "pcchString": "72000000"} "msiexec.exe" called "CryptBinaryToStringW" with parameters {"pbBinary": "0Q0O0M0K0I0" "cbBinary": "83" "dwFlags": "1" "pszString": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEALOu8nnNSKOQduubPzIods=" "pcchString": "72000000"}45:T69b,"msiexec.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg=" "cchString": "0" "dwFlags": "6" "pbBinary": "0Q0O0M0K0I0" "pcbBinary": "53000000"} "msiexec.exe" called "CryptStringToBinaryA" with parameters {"pszString": " INetSim default HTML page

This is the default HTML page for INetSim HTTP server fake mode.

This file is an HTML document.

" "cchString": "258" "dwFlags": "6" "pcbBinary": "00000000" "pdwFlags": "00000000" "$error": "d"} "msiexec.exe" called "CryptStringToBinaryW" with parameters {"pszString": " INetSim default HTML page

This is the default HTML page for INetSim HTTP server fake mode.

This file is an HTML document.

" "cchString": "129" "dwFlags": "6" "pcbBinary": "00000000" "pdwFlags": "00000000" "$error": "d"} "msiexec.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEALOu8nnNSKOQduubPzIods=" "cchString": "0" "dwFlags": "6" "pbBinary": "0Q0O0M0K0I0" "pcbBinary": "53000000"} "msiexec.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAqhJdbWMht+QeQF2jaXwhU=" "cchString": "0" "dwFlags": "6" "pbBinary": "0Q0O0M0K0I0" "pcbBinary": "53000000"}46:T6e1,"msiexec.exe" called "CryptHashData" with parameter 1b701f00 & 84100c0000000000c000000000000046 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & 00000000 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & 0500530075006d006d0061007200790049006e0066006f0072006d006100740069006f006e00 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & b402000000000000 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & 0000000000000000 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & 0b43314135473e40ec468c3a (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & 001e030000000000 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & 0b43314135473e40ec469e3c2043bb412448 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & 009a010000000000 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & 0b43314135473e40ec469e3cbf3ca644bf3bbb412f413048 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & fe02000000000000 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & 0b43314135473e40ec469e3cbf3ca644bf3c71423248 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & _ (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & 0b43314135473e40ec469e3cff3af0447f3b2c41af442a48 (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" with parameter 1b701f00 & ea63090000000000 (UID: 00000000-00006356)47:Ta22,Assembly shows XOR instruction xor al 01h in Stream UID: 49558-19-10004EF0 Assembly shows XOR instruction xor al 01h in Stream UID: 49558-11-100040AA Assembly shows XOR instruction xor al 00h in Stream UID: 49558-11-100040AA Assembly shows XOR instruction xor eax ebp in Stream UID: 49558-3-10004491 Assembly shows XOR instruction xor rdx rax in Stream UID: 53416-9-000000014012B4DC Assembly shows XOR instruction xor edx eax in Stream UID: 53416-9-000000014012B4DC Assembly shows XOR instruction xor rdx r8 in Stream UID: 53416-9-000000014012B4DC Assembly shows XOR instruction xor rdi r8 in Stream UID: 53416-9-000000014012B4DC Assembly shows XOR instruction xor edi eax in Stream UID: 53416-9-000000014012B4DC Assembly shows XOR instruction xor al 88h in Stream UID: 60786-11-1002AB08 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 60786-20-1002B2F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 60786-20-1002B2F0 Assembly shows XOR instruction xor rdx rax in Stream UID: 62569-9-000000014024BB84 Assembly shows XOR instruction xor edx eax in Stream UID: 62569-9-000000014024BB84 Assembly shows XOR instruction xor rdx r8 in Stream UID: 62569-9-000000014024BB84 Assembly shows XOR instruction xor rdi r8 in Stream UID: 62569-9-000000014024BB84 Assembly shows XOR instruction xor edi eax in Stream UID: 62569-9-000000014024BB84 Assembly shows XOR instruction xor esi eax in Stream UID: 63480-9-004149EA Assembly shows XOR instruction xor edi edx in Stream UID: 63480-9-004149EA Assembly shows XOR instruction xor eax dword ptr [0043F070h] in Stream UID: 63480-10-00410486 Assembly shows XOR instruction xor rdx rcx in Stream UID: 65239-19-0000000180038C50 Assembly shows XOR instruction xor edx ecx in Stream UID: 65239-19-0000000180038C50 Assembly shows XOR instruction xor rdx r8 in Stream UID: 65239-19-0000000180038C50 Assembly shows XOR instruction xor edx eax in Stream UID: 65239-19-0000000180038C50 Assembly shows XOR instruction xor rdi r10 in Stream UID: 65239-19-0000000180038C50 Assembly shows XOR instruction xor edi edx in Stream UID: 65239-19-0000000180038C50 Assembly shows XOR instruction xor rdx rax in Stream UID: 65239-11-000000018000C8B4 Assembly shows XOR instruction xor edx eax in Stream UID: 65239-11-000000018000C8B4 Assembly shows XOR instruction xor rdx r8 in Stream UID: 65239-11-000000018000C8B4 Assembly shows XOR instruction xor rdi r8 in Stream UID: 65239-11-000000018000C8B4 Assembly shows XOR instruction xor edi eax in Stream UID: 65239-11-000000018000C8B448:T463,"MsiExec.exe" called "GetVersionExA" with parameter 94000000060000000000000070170000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003844) "MsiExec.exe" called "GetVersionExA" with parameter 94000000060000000000000070170000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003760) "MsiExec.exe" called "GetVersionExA" with parameter 94000000060000000000000070170000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003680)49:T436,Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")4a:T164a,Found reference to API "DllGetVersion" (Indicator: "GetVersion"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API "" (Indicator: "GetVersionExA"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersionExW"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "PRINT,NS_VistaRTMVersionLie::APIHook_RtlGetVersion,174,[ApiName] Hook Entered" (Indicator: "GetVersion"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "" (Indicator: "GetVersionExA"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersionExW"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "GetVersion"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "PRINT,NS_VistaRTMVersionLie::APIHook_RtlGetVersion,174,[ApiName] Hook Entered" (Indicator: "GetVersion"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")4b:T7b8,"msiexec.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "ENABLEDHCP"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")4c:T989,"msiexec.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSIEXEC.EXE") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "COMMENTS") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "CONTACT") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "DISPLAYVERSION") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "HELPLINK") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "HELPTELEPHONE") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "INSTALLDATE") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "INSTALLLOCATION") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "INSTALLSOURCE") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "MODIFYPATH") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "NOMODIFY") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "NOREPAIR") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "PUBLISHER") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "README") "msiexec.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{F0CF025B-D6F3-4F7C-939B-23291F52875C}"; Key: "SIZE")4d:T826d,"msiexec.exe" called "NtOpenSection" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtCreateSection" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtQueryInformationToken" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtOpenFile" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtEnumerateValueKey" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtSetInformationKey" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "LdrLoadDll" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "LdrGetProcedureAddress" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtEnumerateKey" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "RpcStringBindingComposeW" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtReadFile" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtQueryInformationFile" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "LdrGetDllHandle" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtSetInformationFile" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtQueryKey" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtOpenKeyEx" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtWriteFile" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtQueryValueKey" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtFsControlFile" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtCreateKeyEx" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "LdrUnloadDll" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtSetValueKey" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "CryptHashData" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "BCryptImportKeyPair" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtCreateFile" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "CryptBinaryToStringA" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "CryptBinaryToStringW" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "CryptStringToBinaryW" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "CryptStringToBinaryA" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "RpcServerUseProtseqEpW" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "FileTimeToLocalFileTime" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtTerminateProcess" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "RtlGetNtProductType" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "LoadResource" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "GetLocaleInfoW" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "CreateCompatibleBitmap" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "GetWindowTextW" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "CreateToolhelp32Snapshot" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "AdjustTokenPrivileges" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "FindFirstFileW" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "FindNextFileW" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "GetNativeSystemInfo" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "GetSystemDefaultLangID" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "CreateDirectoryW" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "RemoveDirectoryW" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "GetKeyState" (PID: 6356) (UID: 00000000-00006356) "msiexec.exe" called "NtOpenSection" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtCreateSection" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtQueryInformationToken" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtOpenKeyEx" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtQueryValueKey" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtOpenFile" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtQueryKey" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtSetInformationKey" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "LdrGetDllHandle" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "LdrLoadDll" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "RpcStringBindingComposeW" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtCreateKeyEx" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "LdrGetProcedureAddress" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "RpcServerUseProtseqEpW" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "LdrUnloadDll" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtFsControlFile" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtCreateUserProcess" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtEnumerateKey" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtSetInformationFile" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtWriteFile" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtEnumerateValueKey" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtCreateFile" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtReadFile" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "SetFileTime" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtSetValueKey" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "CryptHashData" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "BCryptImportKeyPair" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "CryptBinaryToStringA" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "CryptBinaryToStringW" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "CryptStringToBinaryA" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "CryptStringToBinaryW" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtQueryInformationFile" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "FileTimeToLocalFileTime" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtDeleteKey" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtDeleteValueKey" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "NtTerminateProcess" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "RtlGetNtProductType" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "AdjustTokenPrivileges" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "CreateToolhelp32Snapshot" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "LoadResource" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "FindFirstFileW" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "FindNextFileW" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "GetNativeSystemInfo" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "CreateDirectoryW" (PID: 736) (UID: 00000000-00000736) "msiexec.exe" called "RemoveDirectoryW" (PID: 736) (UID: 00000000-00000736) "MsiExec.exe" called "NtOpenSection" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtCreateSection" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtQueryInformationToken" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtOpenKeyEx" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtQueryValueKey" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtOpenFile" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtSetInformationKey" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtQueryInformationFile" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtEnumerateKey" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtQueryKey" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtEnumerateValueKey" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "LdrLoadDll" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "LdrUnloadDll" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "RpcStringBindingComposeW" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "RpcServerUseProtseqEpW" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtWriteFile" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtCreateFile" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtSetInformationFile" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "LdrGetDllHandle" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtReadFile" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtTerminateProcess" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "RtlGetNtProductType" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "GetNativeSystemInfo" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "AdjustTokenPrivileges" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "CreateToolhelp32Snapshot" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "FindFirstFileW" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "FindNextFileW" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "RtlGetVersion" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "GetLocaleInfoW" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "GetActiveWindow" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "CreateCompatibleBitmap" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "GetWindowTextW" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "GetKeyState" (PID: 6328) (UID: 00000000-00006328) "MsiExec.exe" called "NtOpenSection" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtCreateSection" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtQueryInformationToken" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtOpenKeyEx" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtQueryValueKey" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtOpenFile" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtSetInformationKey" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtQueryInformationFile" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtEnumerateKey" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtQueryKey" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtEnumerateValueKey" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "LdrLoadDll" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "LdrUnloadDll" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "RpcStringBindingComposeW" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "RpcServerUseProtseqEpW" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtWriteFile" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "LdrGetDllHandle" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtCreateFile" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtSetInformationFile" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtCreateKeyEx" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "GetVersionExA" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "WinHttpConnect" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "WinHttpOpenRequest" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "WinHttpSendRequest" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtTerminateProcess" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "RtlGetNtProductType" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "GetNativeSystemInfo" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "CreateToolhelp32Snapshot" (PID: 3844) (UID: 00000000-00003844) "MsiExec.exe" called "NtOpenSection" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtCreateSection" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtQueryInformationToken" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtOpenKeyEx" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtQueryValueKey" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtOpenFile" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtQueryInformationFile" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtEnumerateValueKey" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtQueryKey" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtSetInformationKey" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "LdrGetDllHandle" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "LdrLoadDll" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtEnumerateKey" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "LdrGetProcedureAddress" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "RpcStringBindingComposeW" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "RpcServerUseProtseqEpW" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtWriteFile" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "GetVersionExA" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtCreateKeyEx" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "LdrUnloadDll" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtDeleteValueKey" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtDeleteKey" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtTerminateProcess" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "RtlGetNtProductType" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "CreateToolhelp32Snapshot" (PID: 3760) (UID: 00000000-00003760) "MsiExec.exe" called "NtOpenSection" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtCreateSection" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtQueryInformationToken" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtOpenKeyEx" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtQueryValueKey" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtOpenFile" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtSetInformationKey" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtQueryInformationFile" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtEnumerateKey" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtQueryKey" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtEnumerateValueKey" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "LdrLoadDll" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "LdrUnloadDll" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "RpcStringBindingComposeW" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "RpcServerUseProtseqEpW" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtWriteFile" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtCreateNamedPipeFile" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtCreateUserProcess" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "LdrGetDllHandle" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "NtTerminateProcess" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "RtlGetNtProductType" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "GetNativeSystemInfo" (PID: 2092) (UID: 00000000-00002092) "MsiExec.exe" called "CreateProcessW" (PID: 2092) (UID: 00000000-00002092) "reg.exe" called "NtOpenSection" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtCreateSection" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtQueryInformationToken" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtOpenKeyEx" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtQueryValueKey" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtOpenFile" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtSetInformationKey" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtQueryInformationFile" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtEnumerateKey" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtQueryKey" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtEnumerateValueKey" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtProtectVirtualMemory" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtOpenThread" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtResumeThread" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtQueryAttributesFile" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtMapViewOfSection" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtQueryVolumeInformationFile" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtSetInformationProcess" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "LdrLoadDll" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtQueryInformationProcess" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtAllocateVirtualMemory" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtQuerySystemInformation" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "LdrGetDllHandle" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtCreateEvent" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtNotifyChangeKey" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtOpenThreadToken" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtOpenProcessToken" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtOpenDirectoryObject" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtOpenEvent" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtQueryVirtualMemory" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "LoadLibrary" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtSuspendThread" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtGetContextThread" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtDeviceIoControlFile" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtWriteFile" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtSetInformationThread" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtTerminateProcess" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "CreateToolhelp32Snapshot" (PID: 3648) (UID: 00000000-00003648) "reg.exe" called "NtOpenSection" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtCreateSection" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtQueryInformationToken" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtOpenKeyEx" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtQueryValueKey" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtOpenFile" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtSetInformationKey" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtQueryInformationFile" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtEnumerateKey" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtQueryKey" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtEnumerateValueKey" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtProtectVirtualMemory" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtOpenThread" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtResumeThread" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtAllocateVirtualMemory" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtQueryAttributesFile" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtMapViewOfSection" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtQueryVolumeInformationFile" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtSetInformationProcess" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "LdrLoadDll" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtQueryInformationProcess" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtQuerySystemInformation" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "LdrGetDllHandle" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtCreateEvent" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtNotifyChangeKey" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtOpenThreadToken" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtOpenProcessToken" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtOpenDirectoryObject" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtOpenEvent" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtQueryVirtualMemory" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "LoadLibrary" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtSuspendThread" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtGetContextThread" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtDeviceIoControlFile" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtWriteFile" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtSetInformationThread" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "LdrUnloadDll" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtTerminateProcess" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "CreateToolhelp32Snapshot" (PID: 1536) (UID: 00000000-00001536) "reg.exe" called "NtOpenSection" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtCreateSection" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtQueryInformationToken" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtOpenKeyEx" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtQueryValueKey" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtOpenFile" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtSetInformationKey" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtQueryInformationFile" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtEnumerateKey" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtQueryKey" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtEnumerateValueKey" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtProtectVirtualMemory" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtOpenThread" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtResumeThread" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtQueryInformationProcess" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "GetProcAddress" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "LdrUnloadDll" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtSetInformationProcess" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtCreateEvent" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtQuerySystemInformation" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtOpenEvent" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtAllocateVirtualMemory" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtAlpcConnectPort" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtCreateUserProcess" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtAlpcSendWaitReceivePort" (PID: 880) (UID: 00000000-00000880) "reg.exe" called "NtTerminateProcess" (PID: 880) (UID: 00000000-00000880) "WerFault.exe" called "NtTerminateProcess" (PID: 6108) (UID: 00000000-00006108) "WerFault.exe" called "NtTerminateProcess" (PID: 3424) (UID: 00000000-00003424) "reg.exe" called "NtOpenSection" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtCreateSection" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtQueryInformationToken" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtOpenKeyEx" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtQueryValueKey" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtOpenFile" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtSetInformationKey" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtQueryInformationFile" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtEnumerateKey" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtQueryKey" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtEnumerateValueKey" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtProtectVirtualMemory" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtOpenThread" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtResumeThread" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtAllocateVirtualMemory" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtQueryAttributesFile" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtMapViewOfSection" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtQueryVolumeInformationFile" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtSetInformationProcess" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "LdrLoadDll" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtQueryInformationProcess" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtQuerySystemInformation" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "LdrGetDllHandle" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtCreateEvent" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtNotifyChangeKey" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtOpenThreadToken" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtOpenProcessToken" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtOpenDirectoryObject" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtOpenEvent" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtQueryVirtualMemory" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "LoadLibrary" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtDeviceIoControlFile" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtCreateKeyEx" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtSetValueKey" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtWriteFile" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtSetInformationThread" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "LdrUnloadDll" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtTerminateProcess" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "CreateToolhelp32Snapshot" (PID: 4800) (UID: 00000000-00004800) "reg.exe" called "NtOpenSection" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtCreateSection" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtQueryInformationToken" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtOpenKeyEx" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtQueryValueKey" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtOpenFile" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtSetInformationKey" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtQueryInformationFile" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtEnumerateKey" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtQueryKey" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtEnumerateValueKey" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtProtectVirtualMemory" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtOpenThread" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtResumeThread" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtAllocateVirtualMemory" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtQueryAttributesFile" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtMapViewOfSection" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtQueryVolumeInformationFile" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtSetInformationProcess" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "LdrLoadDll" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtQueryInformationProcess" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtQuerySystemInformation" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "LdrGetDllHandle" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtCreateEvent" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtNotifyChangeKey" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtOpenThreadToken" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtOpenProcessToken" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtOpenDirectoryObject" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtOpenEvent" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtQueryVirtualMemory" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "LoadLibrary" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtSuspendThread" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtGetContextThread" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtDeviceIoControlFile" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtCreateKeyEx" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtSetValueKey" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtWriteFile" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtSetInformationThread" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "LdrUnloadDll" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "NtTerminateProcess" (PID: 3068) (UID: 00000000-00003068) "reg.exe" called "CreateToolhelp32Snapshot" (PID: 3068) (UID: 00000000-00003068) "MsiExec.exe" called "NtOpenSection" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtCreateSection" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtQueryInformationToken" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtOpenKeyEx" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtQueryValueKey" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtOpenFile" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtQueryInformationFile" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtEnumerateValueKey" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtQueryKey" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtSetInformationKey" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "LdrGetDllHandle" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "LdrLoadDll" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtEnumerateKey" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "LdrGetProcedureAddress" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "RpcStringBindingComposeW" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "RpcServerUseProtseqEpW" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtWriteFile" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "GetVersionExA" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtCreateKeyEx" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtDeleteValueKey" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtSetValueKey" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtCreateFile" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtSetInformationFile" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtReadFile" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "LdrUnloadDll" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "NtTerminateProcess" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "RtlGetNtProductType" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "CreateToolhelp32Snapshot" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "FindFirstFileW" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "FindNextFileW" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "CreateDirectoryW" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "CopyFileW" (PID: 3680) (UID: 00000000-00003680) "MsiExec.exe" called "LookupAccountSidW" (PID: 3680) (UID: 00000000-00003680)4e:T713,"msiexec.exe" called "CreateDirectoryW" with parameter C:\MSI2d2c9.tmp (UID: 00000000-00006356) "msiexec.exe" called "CreateDirectoryW" with parameter Z:\MSI2d2ca.tmp (UID: 00000000-00006356) "msiexec.exe" called "CreateDirectoryW" (UID: 00000000-00000736) "msiexec.exe" called "CreateDirectoryW" with parameter C:\Config.Msi (UID: 00000000-00000736) "msiexec.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Paragon (UID: 00000000-00000736) "msiexec.exe" called "CreateDirectoryW" with parameter %TEMP%\lang (UID: 00000000-00000736) "msiexec.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Paragon Software (UID: 00000000-00000736) "msiexec.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows (UID: 00000000-00000736) "msiexec.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\utils (UID: 00000000-00000736) "msiexec.exe" called "CreateDirectoryW" with parameter %TEMP%\dokandrv10x64 (UID: 00000000-00000736) "msiexec.exe" called "CreateDirectoryW" with parameter %WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146 (UID: 00000000-00000736) "msiexec.exe" called "CreateDirectoryW" with parameter %WINDIR%\Installer\{F0CF025B-D6F3-4F7C-939B-23291F52875C} (UID: 00000000-00000736) "msiexec.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software (UID: 00000000-00000736) "MsiExec.exe" called "CreateDirectoryW" with parameter %WINDIR%\system32\DRVSTORE (UID: 00000000-00003680) "MsiExec.exe" called "CreateDirectoryW" with parameter %WINDIR%\system32\DRVSTORE\dokan_03786891CAD255A608C988D6263D8BF068E504FB (UID: 00000000-00003680)4f:T59dd,"msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter srpapi.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TSAPPCMP.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHLWAPI.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHELL32.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\WLDP.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\sxs.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCOREE.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\fusion.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTDLL.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter MsiHnd.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter KERNEL32 (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter DWMAPI (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PCACLI.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter USER32 (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\advapi32.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SFC.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140rus.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140kor.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140jpn.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140ita.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140fra.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140esn.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140enu.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140deu.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140cht.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140chs.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\vcamp140.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfcm140u.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfcm140.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140u.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\vccorlib140.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\concrt140.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\msvcp140.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\vcruntime140.dll (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter RICHED20.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USER32.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00006356) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHLWAPI.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\TSAPPCMP.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NETAPI32.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SRCLIENT.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\WLDP.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCOREE.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\fusion.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\sxs.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RSTRTMGR.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHELL32.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTDLL.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PCACLI.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SFC.DLL (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140rus.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140kor.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140jpn.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140ita.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140fra.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140esn.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140enu.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140deu.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140cht.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140chs.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\vcamp140.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfcm140u.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfcm140.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140u.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\mfc140.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\vccorlib140.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\concrt140.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\msvcp140.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\vcruntime140.dll (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter CABINET (UID: 00000000-00000736) "msiexec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNELBASE.DLL (UID: 00000000-00000736) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\OLE32.DLL (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\RPCRT4.DLL (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\ADVAPI32.DLL (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter %TEMP%\MSI47E9.tmp (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\KERNEL32.DLL (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\USER32.DLL (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter %TEMP%\MSI1750.tmp (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter %TEMP%\MSI1974.tmp (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter %TEMP%\MSI2F7E.tmp (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00006328) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\OLE32.DLL (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\RPCRT4.DLL (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\ADVAPI32.DLL (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8ABF.tmp (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\KERNEL32.DLL (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIADBA.tmp (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB26F.tmp (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB500.tmp (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB84D.tmp (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI85C.tmp (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIBC9.tmp (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI15BD.tmp (UID: 00000000-00003844) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIAE47.tmp (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI986.tmp (UID: 00000000-00003760) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\OLE32.DLL (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\RPCRT4.DLL (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSICBE7.tmp (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\KERNEL32.DLL (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSID9B3.tmp (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIDF42.tmp (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIE02D.tmp (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIE118.tmp (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIE501.tmp (UID: 00000000-00002092) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIEB0D.tmp (UID: 00000000-00002092) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003648) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003648) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003648) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003648) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001536) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001536) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001536) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001536) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004800) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004800) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004800) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004800) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003068) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003068) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003068) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003068) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIFBA8.tmp (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00003680) "MsiExec.exe" called "LoadLibrary" with a parameter SETUPAPI.DLL (UID: 00000000-00003680)50:T11b19,"msiexec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter ResolveDelayLoadsFromDll (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SrpOpenTrackInstall (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SrpCloseTrackInstall (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SHGetPropertyStoreForWindow (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SaferiChangeRegistryScope (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter IsEqualGUID (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CryptDecodeObject (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CryptFindOIDInfo (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SaferGetLevelInformation (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter ApphelpGetMsiProperties (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SdbInitDatabase (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SdbFindFirstMsiPackage_Str (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SdbReleaseDatabase (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CheckElevationEnabled (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter InitCommonControls (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter ImageList_Create (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter ImageList_ReplaceIcon (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter PcaNotifyMsiInstall (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter DwmSetWindowAttribute (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter RtlImageNtHeaderEx (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00006356) "msiexec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateWaitableTimerW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CancelWaitableTimer (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoImpersonateClient (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoRevertToSelf (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter QueryInstanceCount (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateRestrictedToken (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoGetCallContext (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateEnvironmentBlock (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter DestroyEnvironmentBlock (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SRSetRestorePointW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SaferiChangeRegistryScope (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter IsEqualGUID (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CryptDecodeObject (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CryptFindOIDInfo (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SaferGetLevelInformation (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetCORSystemDirectory_RetAddr (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SetMSIHandleForLogging (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter InitializeFusion (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetCachePath (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateApplicationContext (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateAssemblyCache (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateInstallReferenceEnum (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CreateHistoryReader (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter LookupHistoryAssembly (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetHistoryFileDirectory (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter InstallCustomModule (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter PreBindAssembly (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter PreBindAssemblyEx (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter NukeDownloadedCache (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter ClearDownloadCache (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CopyPDBs (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter ApphelpGetMsiProperties (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SdbInitDatabase (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SdbFindFirstMsiPackage_Str (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SdbReleaseDatabase (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter GlobalMemoryStatusEx (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CheckElevationEnabled (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter PcaNotifyMsiInstall (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RtlImageNtHeaderEx (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter StgCreateStorageEx (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter FDICreate (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter FDICopy (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter FDIIsCabinet (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter FDIDestroy (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter SfcIsKeyProtected (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter ChangeServiceConfig2W (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter NotifyRedirectedStringChange (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoFreeUnusedLibraries (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00000736) "msiexec.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00000736) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter DllGetVersion (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter _TrackMouseEvent (UID: 00000000-00006328) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00003844) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter ProcessDriverPackages (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter WerUnregisterRuntimeExceptionModule (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CleanupOnSuccess (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00003760) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002092) "MsiExec.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002092) "reg.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003648) "reg.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001536) "reg.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000880) "reg.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004800) "reg.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003068) "reg.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003068) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter InstallDriverPackages (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter pSetupInstallCatalog (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter WerUnregisterRuntimeExceptionModule (UID: 00000000-00003680) "MsiExec.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00003680)51:T2725,"SELECT `Text` FROM `Control` WHERE `Control`='LicenseText'" (Source: 9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin, Indicator: "select `text` from `control` where `control`='licensetext'") "SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` > 0 ORDER BY `Sequence`" (Source: 00000000-00000736.00000002.82905.14B63000.00000004.mdmp, 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `action`,null,`condition` from `installexecutesequence` where `sequence` > 0 order by `sequence`") "SELECT `ComponentId`, `BinaryType`, `Action` From `Component` WHERE (`Component_Parent` = null OR `Component_Parent` = `Component`) AND `ComponentId` <> null AND (`ActionRequest` = 0)" (Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp, Indicator: "select `componentid`, `binarytype`, `action` from `component` where (`component_parent` = null or `component_parent` = `component`) and `componentid` <> null and (`actionrequest` = 0)"), "SELECT * FROM #_MsiRedirectedFile WHERE `Sequence` IS NOT NULL ORDER BY `Sequence`" (Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp, Indicator: "select * from #_msiredirectedfile where `sequence` is not null order by `sequence`"), "SELECT `Patch`.`File_` `Patch`.`Header` `Patch`.`Attributes` `Patch`.`Sequence` `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `patch`.`file_` `patch`.`header` `patch`.`attributes` `patch`.`sequence` `patch`.`streamref_` from `patch` where `patch`.`file_` = ? and `patch`.`#_msiactive`=? order by `patch`.`sequence`"), "SELECT `DiskId` `PatchId` `LastSequence` FROM `Media` `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId`" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `diskid` `patchid` `lastsequence` from `media` `patchpackage` where `media`.`diskid`=`patchpackage`.`media_` order by `diskid`"), "SELECT `Root` `Key` `Name` `Value` FROM `Registry` `Component` WHERE `Registry`=? AND `Registry`.`Component_` = `Component`.`Component`" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `root` `key` `name` `value` from `registry` `component` where `registry`=? and `registry`.`component_` = `component`.`component`"), "SELECT `Name` `Value` FROM `Environment` `Component` WHERE `Component_`=`Component` AND (`Component`.`Action` = 1 OR `Component`.`Action` = 2)" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `name` `value` from `environment` `component` where `component_`=`component` and (`component`.`action` = 1 or `component`.`action` = 2)"), "SELECT `File`.`File` `File`.`FileName` `Component`.`Directory_` `Component`.`Attributes` `Component`.`KeyPath` `Component`.`ActionRequest` `BinaryType` FROM `File` `Component` WHERE `File`.`Component_` = `Component`.`Component` AND `Component`.`Component` = ?" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `file`.`file` `file`.`filename` `component`.`directory_` `component`.`attributes` `component`.`keypath` `component`.`actionrequest` `binarytype` from `file` `component` where `file`.`component_` = `component`.`component` and `component`.`component` = ?"), "SELECT `Feature` `Feature_Parent` FROM `Feature` WHERE (`Feature`.`Installed` = null OR `Feature`.`Installed` = 0) AND (`Feature`.`Action` = null OR `Feature`.`Action` = 0 OR `Feature`.`Action` = 3) AND `Feature`.`RuntimeLevel` > 0" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `feature` `feature_parent` from `feature` where (`feature`.`installed` = null or `feature`.`installed` = 0) and (`feature`.`action` = null or `feature`.`action` = 0 or `feature`.`action` = 3) and `feature`.`runtimelevel` > 0"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'MsiRollbackInstall'" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'msirollbackinstall'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'SetWindowsOsName'" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'setwindowsosname'"), "SELECT `FileName` `Version` `State` `File`.`Attributes` `TempAttributes` `File` `FileSize` `Language` `Sequence` `Directory_` `Installed` `Action` `Component` `ForceLocalFiles` `ComponentId` NULL FROM `File` `Component` WHERE `Component`=`Component_` AND `File`=?" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `filename` `version` `state` `file`.`attributes` `tempattributes` `file` `filesize` `language` `sequence` `directory_` `installed` `action` `component` `forcelocalfiles` `componentid` null from `file` `component` where `component`=`component_` and `file`=?"), "SELECT `ComponentId` FROM `FeatureComponents` `Component` WHERE `Component` = `Component_` AND `Feature_` = ?" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `componentid` from `featurecomponents` `component` where `component` = `component_` and `feature_` = ?"), "SELECT `Feature` `Feature_Parent` FROM `Feature` WHERE ((`Feature`.`Action` = 1 OR `Feature`.`Action` = 2) OR (`Feature`.`Action` = 4 AND `Feature`.`Installed` = 0) OR (`Feature`.`Action` = 3 AND (`Feature`.`Installed` = 1 OR `Feature`.`Installed` = 2 OR `Feature`.`Installed` = 4)))" (Source: 00000000-00000736.00000002.82905.265A9000.00000004.mdmp, Indicator: "select `feature` `feature_parent` from `feature` where ((`feature`.`action` = 1 or `feature`.`action` = 2) or (`feature`.`action` = 4 and `feature`.`installed` = 0) or (`feature`.`action` = 3 and (`feature`.`installed` = 1 or `feature`.`installed` = 2 or `feature`.`installed` = 4)))"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'QtExecLocalCrashDumpFolder'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'qtexeclocalcrashdumpfolder'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'QtExecImportOldProperties'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'qtexecimportoldproperties'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'MsiInstallDrivers64'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'msiinstalldrivers64'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'MsiRollbackInstall64'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'msirollbackinstall64'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'LocalCrashDumpCount'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'localcrashdumpcount'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'MsiProcessDrivers64'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'msiprocessdrivers64'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'AddScheduledUpdaterTask'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'addscheduledupdatertask'"), "SELECT `Patch`.`Sequence` `Patch`.`PatchSize` `Patch`.`Attributes` `Patch`.`Header` `Patch`.`StreamRef_` FROM `File` `Patch` `Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence`" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `patch`.`sequence` `patch`.`patchsize` `patch`.`attributes` `patch`.`header` `patch`.`streamref_` from `file` `patch` `component` where `file`=? and `file`=`file_` and `component`=`component_` order by `patch`.`sequence`"), "SELECT `Patch`.`Sequence` `Patch`.`PatchSize` `Patch`.`Attributes` `Patch`.`Header` `Patch`.`StreamRef_` FROM `File` `Pa0" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `patch`.`sequence` `patch`.`patchsize` `patch`.`attributes` `patch`.`header` `patch`.`streamref_` from `file` `pa0"), "SELECT `FileName` `Version` `State` `File`.`Attributes` `TempAttributes` `File` `FileSize` `Language` `Sequence` `Directory_` `Installed` `Action` `Component` FROM `File` `Component` WHERE `Component`=`Component_` AND `Component_`=? AND `Directory_`=?" (Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, Indicator: "select `filename` `version` `state` `file`.`attributes` `tempattributes` `file` `filesize` `language` `sequence` `directory_` `installed` `action` `component` from `file` `component` where `component`=`component_` and `component_`=? and `directory_`=?")52:Tb0c,Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegCreateKey"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "RegCreateKeyExW" (Indicator: "RegCreateKey"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")53:T476,Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp")54:Te8ae,Found reference to API (Indicator: "GetIconInfo"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "BitBlt"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "SelectObject"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "MoveWindow"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "GetWindowPlacement"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "DrawMenuBar"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "SetWindowPos"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "SetFocus"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "AnimateWindow"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "ReleaseCapture"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "SetCursorPos"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "UpdateWindow"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "GetMenuItemInfo"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "RegisterHotKey"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "UnregisterHotKey"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "SetStretchBltMode"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "TextOut"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "CreateFont"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "StretchBlt"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "GetTextMetrics"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "SetWindowRgn"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "LoadCursor"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "CreateIconIndirect"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "FreeConsole"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "ReadConsoleOutputCharacterA"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "SetConsoleCursorPosition"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "WriteConsole"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "GlobalUnlock"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "GetTextExtentPoint32"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "SetMenuItemInfo"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "CreatePopupMenu"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "RemoveMenu"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "InsertMenu"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "ModifyMenu"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "CreateMenu"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "AppendMenu"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "GetScrollInfo"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "EnableMenuItem"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "CheckMenuRadioItem"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "GlobalFree"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "SafeArrayPtrOfIndex"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "FindClose"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "GetTempPath"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "GetTempFileName"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "IsWow64Process"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "CloseHandle"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "SetEvent"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "RegDeleteKeyEx"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "ExpandEnvironmentStrings"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "SHGetFileInfo"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "WNetOpenEnumW"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "WNetEnumResourceW"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "WNetCloseEnum"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "CreateCaret"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "DestroyCaret"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "ShowCaret"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API (Indicator: "Beep"; Source: "00000000-00000736.00000000.79067.C04D0000.00000002.mdmp, 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp, 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CreateWaitableTimerW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CancelWaitableTimer"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "AddAccessAllowedAce"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegisterServiceCtrlHandlerW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetServiceStatus"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CreateWaitableTimerW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CancelWaitableTimer"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "MakeAbsoluteSD"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "AddAccessAllowedAce"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetThreadToken"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegisterServiceCtrlHandlerW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetServiceStatus"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetAce"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")55:T8d6,Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp")56:T5f4,Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcess"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcess"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")57:Ta0a,Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartService"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "StartServices" (Indicator: "StartService"; Source: "00000000-00000736.00000002.82905.264C0000.00000004.mdmp, 00000000-00000736.00000002.82905.268B0000.00000004.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcher failed." (Indicator: "StartService"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartServiceCtrlDispatcher"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "StartServiceCtrlDispatcherW" (Indicator: "StartService"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "StartServices" (Indicator: "StartService"; Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp")58:Taf25,"Software\Policies\Microsoft\Windows\Installer" in Source: 9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin "pSoftware\Policies\Microsoft\Control Panel" in Source: 9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin "Software\Policies\Microsoft\Windows\Control Panel" in Source: 9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin "Software\" in Source: 9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin "Software\Classes\" in Source: 9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin "SOFTWARE\Paragon Software\Linux File Systems for Windows by Paragon Software" in Source: 9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\ParagonMounter.log" in Source: 00000000-00006356-00000C21-26656500902 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\FS4WinUI.log" in Source: 00000000-00006356-00000C21-26886641869 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\*.dmp" in Source: 00000000-00006356-00000C21-26887463430 "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00006356-00000C21-26893027364 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356-00000455-79219938106 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\updater_lang.qm" in Source: 00000000-00000736-00000BC1-140127555 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\FS4WinUI_lang.qm" in Source: 00000000-00000736-00000BC1-140166622 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\qtbase.qm" in Source: 00000000-00000736-00000BC1-140199576 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\Updater.exe" in Source: 00000000-00000736-00000BC1-140231753 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\utils\cygwin1.dll" in Source: 00000000-00000736-00000BC1-140244399 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\utils\e2fsck.exe" in Source: 00000000-00000736-00000BC1-140251545 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\utils\mke2fs.exe" in Source: 00000000-00000736-00000BC1-140261231 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\utils\mklost+found.exe" in Source: 00000000-00000736-00000BC1-140268959 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\utils\mke2fs-hurd.conf" in Source: 00000000-00000736-00000BC1-140273303 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\utils\mke2fs.conf" in Source: 00000000-00000736-00000BC1-140276682 "02:\Software\Paragon Software\Linux File Systems for Windows by Paragon Software\service\AutoMount" in Source: 00000000-00000736-00000BC1-140279450 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe" in Source: 00000000-00000736-00000BC1-140289348 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\Qt5Gui.dll" in Source: 00000000-00000736-00000BC1-140292649 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\Qt5Core.dll" in Source: 00000000-00000736-00000BC1-140295904 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\Qt5Widgets.dll" in Source: 00000000-00000736-00000BC1-140300711 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\platforms\qwindows.dll" in Source: 00000000-00000736-00000BC1-140304204 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\utils\fsdump.exe" in Source: 00000000-00000736-00000BC1-140310468 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\extmounter.exe" in Source: 00000000-00000736-00000BC1-140313705 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\dokan.dll" in Source: 00000000-00000736-00000BC1-140317426 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00000736-00000BC1-142214519 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows" in Source: 00000000-00000736-00000C32-150992348972 "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\utils" in Source: 00000000-00000736-00000C32-150993285656 ""%WINDIR%\SysWOW64\reg.exe" COPY "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" "HKEY_LOCAL_MACHINE\SOFTWARE\P" in Source: 00000000-00002092-00000C3A-3967533204, ""%WINDIR%\SysWOW64\reg.exe" DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" /reg:32 /f" in Source: 00000000-00002092-00000C3A-7850989902, ""%WINDIR%\SysWOW64\reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_servic" in Source: 00000000-00002092-00000C3A-12420502672 "COPY "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\Linux File Systems for Windows by Paragon Software" /reg:32 /s /f" in Source: reg.exe "DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" /reg:32 /f" in Source: reg.exe "ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpFolder /t REG_EXPAND_SZ /d "%PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\crashdumps"" in Source: reg.exe "ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpType /t REG_DWORD /d 1" in Source: reg.exe "ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpCount /t REG_DWORD /d 16" in Source: reg.exe "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp 00000000-00000736.00000002.82905.14B63000.00000004.mdmp 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\CA" in Source: 00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpType /t REG_DWORD /d 1" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp "Software\Paragon Software\Linux File Systems for Windows by Paragon Software\Update" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\qwindows.dll" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp 00000000-00000736.00000002.82905.268B0000.00000004.mdmp "Software\Paragon Software\Linux File Systems for Windows by Paragon Software\service" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp "ogram Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86=" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp, "\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows" in Source: 00000000-00000736.00000002.82905.23860000.00000004.mdmp, ""[SystemFolder]reg.exe" DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" /reg:32 /f" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Installer\Folders" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, "Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, "older]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpType /t REG_DWORD /d 1" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpCount /t REG_DWORD /d 16" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp 00000000-00000736.00000002.82905.288B0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp 00000000-00000736.00000002.82905.268B0000.00000004.mdmp 00000000-00000736.00000002.82905.288B0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "s (x86)\Paragon Software\LinuxF" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\linux file systems for windows by paragon software.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp ""[SystemFolder]reg.exe" COPY "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\Linux File Systems for Windows by Paragon Software" /reg:32 /s /f" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpFolder /t REG_EXPAND_SZ /d "[INSTALLFOLDER]crashdumps"" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\;DESKTOP-FVVF82A\HAPUBWS;WixPerMachineFolder" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\System\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\qt5gui.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\qtbase.qm" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Updater.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\updater.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Qt5Widgets.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\qt5core.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\dokan.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp 00000000-00000736.00000002.82905.268B0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp 00000000-00000736.00000002.82905.268B0000.00000004.mdmp "\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\f462\fs20\lang1033\langfe1049\langnp1033\insrsid2884417\charrsid10443953 \hich\af462\dbch\af31505\loch\f462 Unless determined otherwise, Paragon grants the software\loch\af462\dbch\af31505\hich\f462 \rquote \loch\f462" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "s end user the simple right to install the software on a device and use it for an unlimited period of time. The right to use is limited to the software\hich\f462 \rquote \loch\f462" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\Linux File Systems for Windows by Paragon Software.lnk" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\Program Files (x86)\Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432N" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\utils\e2fsck.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\utils\fsdump.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\utils\cygwin1.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\qt5widgets.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\paragon_service.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\fs4winui_lang.qm" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\utils\mke2fs.conf" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\utils\mke2fs.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\extmounter.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\paragon_service.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\updater_lang.qm" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp ""C:\WINDOWS\SysWOW64\reg.exe" DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" /reg:32 /f" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "n Software\LinuxFS for Windows\" DOKANDRV7X86" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, "DIFXAPP: INFO: creating HKEY_USERS\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{591533B2-E8D2-4241-9C3D-55848451635D} (User's SID: 'S-1-5-21-735145574-3570218355-1207367261-1001') ...;a" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, "SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X86" in Source: 00000000-00000736.00000002.82905.265A9000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\ls\" in Source: 00000000-00000736.00000002.82905.265A9000.00000004.mdmp, "Software\Classes" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "SOFTWARE\Microsoft\DevDiv\VC\Servicing\14.0" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "c:\program files (x86)\paragon software\linuxfs for windows\platforms\qwindows.dll" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "c:\program files (x86)\paragon software\linuxfs for windows\utils\mklost+found.exe" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "c:\program files (x86)\paragon software\linuxfs for windows\utils\mke2fs-hurd.conf" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\mklost+found.exe" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Updater.exe" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "1\rtfv5x7c\7jdln7zw\|Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "\rtfv5x7c\7jdln7zw\|Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\qtbase.qm" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" SourceDir=""" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, ""C:\WINDOWS\SysWOW64\reg.exe" COPY "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\Linux File Systems for Windows by Paragon Software" /reg:32 /s /f" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, ". The right to use is limited to the software\hich\f462 \rquote \loch\f4" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "rms\on Software\LinuxFS for Windows\.exe" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, ""C:\WINDOWS\SysWOW64\reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpCount /t REG_DWORD /d 16" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, ""C:\WINDOWS\SysWOW64\reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpType /t REG_DWORD /d 1" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, "4-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{591533B2-E8D2-4241-9C3D-55848451635D} (User's SID: 'S-1-5-21-735145574-3570218355-1207367261-1001') ..." in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, ":\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, ""C:\WINDOWS\SysWOW64\reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpFolder /t REG_EXPAND_SZ /d "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\crashdumps"" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, ":\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "Software\Microsoft\RegEdt32" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, 00000000-00006356.00000002.82407.C0530000.00000002.mdmp, "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\Installer\CA" in Source: 00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp, ":\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000001.80484.1BCF0000.00000002.mdmp, "??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\Linux File Systems for Windows by Paragon Software.lnk" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "Software\Paragon Software\Linux File Systems for Windows by Paragon Software\Update" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "Software\Paragon Software\Linux File Systems for Windows by Paragon Software\service" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, ""[SystemFolder]reg.exe" COPY "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\Linux File Systems for Windows by Paragon Software" /reg:32 /s /f" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpFolder /t REG_EXPAND_SZ /d "[INSTALLFOLDER]crashdumps"" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "PROCESSOR_ARCHITECTURE=AMD64\REGISTRY\MACHINE\SOFTWARE\Classes\WOW64" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "Paragon Software\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Qt5Core.dll" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Updater.exe" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\Linux File Systems for Windows by Paragon Software.lnk" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\qwindows.dll" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "{\WixUI_Font_Normal_10}C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "rogram Files (x86)\Paragon Software\LinuxFS for Windows\utils\mke2fs-hurd.conf" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows" in Source: 00000000-00006356.00000001.80484.1E140000.00000004.mdmp, 00000000-00006356.00000002.82407.1E140000.00000004.mdmp, ""[SystemFolder]reg.exe" DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" /reg:32 /f" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpType /t REG_DWORD /d 1" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpCount /t REG_DWORD /d 16" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\System\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\cygwin1.dll" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\dokan.dll" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Qt5Widgets.dll" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\f462\fs20\lang1033\langfe1049\langnp1033\insrsid2884417\charrsid10443953 \hich\af462\dbch\af31505\loch\f462 Unless determined otherwise Paragon grants the software\loch\af462\dbch\af31505\hich\f462 \rquote \loch\f462" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "s end user the simple right to install the software on a device and use it for an unlimited period of time. The right to use is limited to the software\hich\f462 \rquote \loch\f462" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "e\Software\C" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\fsdump.exe" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64" in Source: 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="C:\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\"" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\WOW6432N" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp59:T843,"Qt5Core.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "paragon_service.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "Linux File Systems for Windows by Paragon Software.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "fsdump.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "Updater.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "qwindows.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "msvcp140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "dokan.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "vcamp140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "extmounter.exe" has flags like IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "vccorlib140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "concrt140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "mfcm140u.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT5a:Te695,"\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00000736.00000000.79067.C04D0000.00000002.mdmp "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\CA" in Source: 00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00000736.00000001.80985.C04D0000.00000002.mdmp "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\CA" in Source: 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00000736.00000002.82905.14B63000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpType /t REG_DWORD /d 1" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="C:\" CLIENTUILEVEL="0" CLIENTPROCESSID="6356" USERNAME="BJKBX9O" SOURCEDIR="C:\" ACTION="INSTALL" EXECUTEACTION="INSTALL" ROOTDRIVE="C:\" INSTALLLEVEL="1" WIXUI_INSTALLDIR_VALID="1" SECONDSEQUENCE="1" ADDLOCAL=linuxfs4win_gui,dokanlib.x64,dokandrv.x64,linuxfs4win,VCRedist,linuxfs4win_cmdline " in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="C:\" CLIENTUILEVEL="0" CLIENTPROCESSID="6356" USERNAME="BJKBX9O" SOURCEDIR="C:\" ACTION="INSTALL" EXECUTEACTION="INSTALL" ROOTDRIVE="C:\" INSTALLLEVEL="1" WIXUI_INSTALLDIR_VALID="1" SECONDSEQUENCE="1" ADDLOCAL=linuxfs4win_gui,dokanlib.x64,dokandrv.x64,linuxfs4win,VCRedist,linuxfs4win_cmdline ACTION=INSTALL" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp "Software\Paragon Software\Linux File Systems for Windows by Paragon Software\Update" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\qwindows.dll" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp "Software\Paragon Software\Linux File Systems for Windows by Paragon Software\service" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp "ogram Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86=" in Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp, "\REGISTRY\USER\S-1-5-18\Software\Microsoft\Windows" in Source: 00000000-00000736.00000002.82905.23860000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, "DIFXAPP: INFO: creating HKEY_USERS\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{591533B2-E8D2-4241-9C3D-55848451635D} (User's SID: 'S-1-5-21-735145574-3570218355-1207367261-1001') ...;a" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, ""[SystemFolder]reg.exe" DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" /reg:32 /f" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, "Software\Microsoft\Windows\CurrentVersion\Installer\Folders" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, "Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, "older]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpType /t REG_DWORD /d 1" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpCount /t REG_DWORD /d 16" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "s (x86)\Paragon Software\LinuxF" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\linux file systems for windows by paragon software.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp ""[SystemFolder]reg.exe" COPY "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\Linux File Systems for Windows by Paragon Software" /reg:32 /s /f" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpFolder /t REG_EXPAND_SZ /d "[INSTALLFOLDER]crashdumps"" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\;DESKTOP-FVVF82A\HAPUBWS;WixPerMachineFolder" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\System\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\qt5gui.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\qtbase.qm" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Updater.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\updater.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Qt5Widgets.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\qt5core.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\dokan.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\f462\fs20\lang1033\langfe1049\langnp1033\insrsid2884417\charrsid10443953 \hich\af462\dbch\af31505\loch\f462 Unless determined otherwise, Paragon grants the software\loch\af462\dbch\af31505\hich\f462 \rquote \loch\f462 " in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "s end user the simple right to install the software on a device and use it for an unlimited period of time. The right to use is limited to the software\hich\f462 \rquote \loch\f462 " in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\Linux File Systems for Windows by Paragon Software.lnk" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\Program Files (x86)\Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\WOW6432N" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\utils\e2fsck.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\utils\fsdump.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\utils\cygwin1.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\qt5widgets.dll" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\paragon_service.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\fs4winui_lang.qm" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\utils\mke2fs.conf" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\utils\mke2fs.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\extmounter.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\paragon_service.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "c:\program files (x86)\paragon software\linuxfs for windows\updater_lang.qm" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp ""C:\WINDOWS\SysWOW64\reg.exe" DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" /reg:32 /f" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp "n Software\LinuxFS for Windows\" DOKANDRV7X86" in Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\ls\" in Source: 00000000-00000736.00000002.82905.265A9000.00000004.mdmp, "SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X86" in Source: 00000000-00000736.00000002.82905.265A9000.00000004.mdmp, ". The right to use is limited to the software\hich\f462 \rquote \loch\f4" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "rms\on Software\LinuxFS for Windows\.exe " in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "Software\Classes" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "SOFTWARE\Microsoft\DevDiv\VC\Servicing\14.0" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "c:\program files (x86)\paragon software\linuxfs for windows\platforms\qwindows.dll" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "c:\program files (x86)\paragon software\linuxfs for windows\utils\mklost+found.exe" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\qwindows.dll" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "c:\program files (x86)\paragon software\linuxfs for windows\utils\mke2fs-hurd.conf" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\mklost+found.exe" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Updater.exe" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "1\rtfv5x7c\7jdln7zw\|Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "\rtfv5x7c\7jdln7zw\|Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\qtbase.qm" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" SourceDir="" " in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="C:\" CLIENTUILEVEL="0" CLIENTPROCESSID="6356" USERNAME="BJKBX9O" ACTION="INSTALL" EXECUTEACTION="INSTALL" ROOTDRIVE="C:\" INSTALLLEVEL="1" WIXUI_INSTALLDIR_VALID="1" SECONDSEQUENCE="1" " in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, ""C:\WINDOWS\SysWOW64\reg.exe" COPY "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\Linux File Systems for Windows by Paragon Software" /reg:32 /s /f" in Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, ""C:\WINDOWS\SysWOW64\reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpCount /t REG_DWORD /d 16" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, ""C:\WINDOWS\SysWOW64\reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpType /t REG_DWORD /d 1" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, "4-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\{591533B2-E8D2-4241-9C3D-55848451635D} (User's SID: 'S-1-5-21-735145574-3570218355-1207367261-1001') ..." in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, ":\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, ""C:\WINDOWS\SysWOW64\reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpFolder /t REG_EXPAND_SZ /d "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\crashdumps"" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, ":\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpCount /t REG_DWORD /d 16" in Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "Software\Microsoft\RegEdt32" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00000736.00000002.82905.C04D0000.00000002.mdmp, "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\Installer\CA" in Source: 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp, "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "Software\Microsoft\RegEdt32" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006356.00000000.78565.C0530000.00000002.mdmp, "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\Installer\CA" in Source: 00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, ":\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000001.80484.1BCF0000.00000002.mdmp, "??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\Linux File Systems for Windows by Paragon Software.lnk" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "Software\Paragon Software\Linux File Systems for Windows by Paragon Software\Update" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "Software\Paragon Software\Linux File Systems for Windows by Paragon Software\service" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, ""[SystemFolder]reg.exe" COPY "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\Linux File Systems for Windows by Paragon Software" /reg:32 /s /f" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpFolder /t REG_EXPAND_SZ /d "[INSTALLFOLDER]crashdumps"" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "PROCESSOR_ARCHITECTURE=AMD64\REGISTRY\MACHINE\SOFTWARE\Classes\WOW64" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "Paragon Software\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Qt5Core.dll" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Updater.exe" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\Linux File Systems for Windows by Paragon Software.lnk" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\qwindows.dll" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "{\WixUI_Font_Normal_10}C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "rogram Files (x86)\Paragon Software\LinuxFS for Windows\utils\mke2fs-hurd.conf" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00006356.00000001.80484.1E040000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows" in Source: 00000000-00006356.00000001.80484.1E140000.00000004.mdmp, ""[SystemFolder]reg.exe" DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" /reg:32 /f" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpType /t REG_DWORD /d 1" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpCount /t REG_DWORD /d 16" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\System\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\cygwin1.dll" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\dokan.dll" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Qt5Widgets.dll" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "\f462\fs20\lang1033\langfe1049\langnp1033\insrsid2884417\charrsid10443953 \hich\af462\dbch\af31505\loch\f462 Unless determined otherwise Paragon grants the software\loch\af462\dbch\af31505\hich\f462 \rquote \loch\f462 " in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "s end user the simple right to install the software on a device and use it for an unlimited period of time. The right to use is limited to the software\hich\f462 \rquote \loch\f462 " in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "e\Software\C" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\fsdump.exe" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00006356.00000001.80484.1F470000.00000004.mdmp, "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "Software\Microsoft\RegEdt32" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006356.00000001.80484.C0530000.00000002.mdmp, "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\Installer\CA" in Source: 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, "-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{F" in Source: 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64" in Source: 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="C:\" CLIENTUILEVEL="0" CLIENTPROCESSID="6356" USERNAME="BJKBX9O" SOURCEDIR="C:\" ACTION="INSTALL" EXECUTEACTION="INSTALL" ROOTDRIVE="C:\" INSTALLLEVEL="1" WIXUI_INSTALLDIR_VALID="1" SECONDSEQUENCE="1" ADDLOCAL=linuxfs4win_gui dokanlib.x64 dokandrv.x64 linuxfs4win VCRedist linuxfs4win_cmdline " in Source: 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp, "??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\Linux File Systems for Windows by Paragon Software.lnk" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "Software\Paragon Software\Linux File Systems for Windows by Paragon Software\Update" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "Software\Paragon Software\Linux File Systems for Windows by Paragon Software\service" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, ""[SystemFolder]reg.exe" COPY "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\Linux File Systems for Windows by Paragon Software" /reg:32 /s /f" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpFolder /t REG_EXPAND_SZ /d "[INSTALLFOLDER]crashdumps"" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="C:\" CLIENTUILEVEL="0" CLIENTPROCESSID="6356" USERNAME="BJKBX9O" SOURCEDIR="C:\" ACTION="INSTALL" EXECUTEACTION="INSTALL" ROOTDRIVE="C:\" INSTALLLEVEL="1" WIXUI_INSTALLDIR_VALID="1" SECONDSEQUENCE="1" ADDLOCAL=linuxfs4win_gui dokanlib.x64 dokandrv.x64 linuxfs4win VCRedist linuxfs4win_cmdline " in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "Paragon Software\" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\Linux File Systems for Windows by Paragon Software.lnk" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\qwindows.dll" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "rogram Files (x86)\Paragon Software\LinuxFS for Windows\utils\mke2fs-hurd.conf" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00006356.00000002.82407.1E040000.00000004.mdmp, "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows" in Source: 00000000-00006356.00000002.82407.1E140000.00000004.mdmp, ""[SystemFolder]reg.exe" DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Paragon Software\ExtFS for Windows" /reg:32 /f" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpType /t REG_DWORD /d 1" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, ""[SystemFolder]reg.exe" ADD "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps\paragon_service.exe" /f /reg:64 /v DumpCount /t REG_DWORD /d 16" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\System\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\cygwin1.dll" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\dokan.dll" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\f462\fs20\lang1033\langfe1049\langnp1033\insrsid2884417\charrsid10443953 \hich\af462\dbch\af31505\loch\f462 Unless determined otherwise Paragon grants the software\loch\af462\dbch\af31505\hich\f462 \rquote \loch\f462 " in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "s end user the simple right to install the software on a device and use it for an unlimited period of time. The right to use is limited to the software\hich\f462 \rquote \loch\f462 " in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "??\C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "e\Software\C" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Linux File Systems for Windows by Paragon Software\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "Paragon Software\LinuxFS for Windows\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\fsdump.exe" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\Program Files (x86)\Paragon Software\LinuxFS for Windows\Dokan\DokanLibrary\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="C:\" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" " in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\REGISTRY\MACHINE\SOFTWARE\WOW6432N" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="C:\" CLIENTUILEVEL="0" CLIENTPROCESSID="6356" USERNAME="BJKBX9O" SOURCEDIR="C:\" ACTION="INSTALL" EXECUTEACTION="INSTALL" ROOTDRIVE="C:\" INSTALLLEVEL="1" WIXUI_INSTALLDIR_VALID="1" SECONDSEQUENCE="1" ADDLOCAL=linuxfs4win_gui dokanlib.x64 dokandrv.x64 linuxfs4win VCRedist linuxfs4win_cmdline " in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp, "\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="C:\" CLIENTUILEVEL="0" CLIENTPROCESSID="6356" USERNAME="BJKBX9O" SOURCEDIR="C:\" ACTION="INSTALL" EXECUTEACTION="INSTALL" ROOTDRIVE="C:\" INSTALLLEVEL="1" WIXUI_INSTALLDIR_VALID="1" SECONDSEQUENCE="1" " in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp "WIN10FOUND="C:\WINDOWS\SysWOW64\advapi32.dll" ACTIVATION_LANG_DE="C:\Users\BJKBX9O\AppData\Local\Temp\lang\de\" ACTIVATION_LANG_EN="C:\Users\BJKBX9O\AppData\Local\Temp\lang\en\" ACTIVATION_LANG_ES="C:\Users\BJKBX9O\AppData\Local\Temp\lang\es\" ACTIVATION_LANG_FR="C:\Users\BJKBX9O\AppData\Local\Temp\lang\fr\" ACTIVATION_LANG_IT="C:\Users\BJKBX9O\AppData\Local\Temp\lang\it\" ACTIVATION_LANG_RU="C:\Users\BJKBX9O\AppData\Local\Temp\lang\ru\" ACTIVATION_LANG_ZH="C:\Users\BJKBX9O\AppData\Local\Temp\lang\zh\" INSTALLFOLDER="C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\" DOKANDRV7X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x86\" DOKANDRV10X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x86\" DOKANDRV7X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv7x64\" DOKANDRV10X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv10x64\" DOKANDRV8X86="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x86\" DOKANDRV8X64="C:\Users\BJKBX9O\AppData\Local\Temp\dokandrv8x64\" TARGETDIR="C:\" CURRENTDIRECTORY="C:\" CLIENTUILEVEL="0" CLIENTPROCESSID="6356" USERNAME="BJKBX9O" SOURCEDIR="C:\" ACTION="INSTALL" EXECUTEACTION="INSTALL" ROOTDRIVE" in Source: 00000000-00006356.00000002.82407.1F470000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00006356.00000002.82407.C0530000.00000002.mdmp "Software\Policies\Microsoft\Windows\Installer" in Source: 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\CA" in Source: 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Installer\RunOnceEntries" in Source: 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp5b:T57d2,"msiexec.exe" loaded module "%WINDIR%\System32\msiexec.exe" at C0EF0000 "msiexec.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 5AC90000 "msiexec.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 58DC0000 "msiexec.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 57160000 "msiexec.exe" loaded module "%WINDIR%\System32\apphelp.dll" at 553E0000 "msiexec.exe" loaded module "%WINDIR%\System32\AcLayers.dll" at 39140000 "msiexec.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 58FC0000 "msiexec.exe" loaded module "%WINDIR%\System32\user32.dll" at 59310000 "msiexec.exe" loaded module "%WINDIR%\System32\win32u.dll" at 57530000 "msiexec.exe" loaded module "%WINDIR%\System32\gdi32.dll" at 58280000 "msiexec.exe" loaded module "%WINDIR%\System32\gdi32full.dll" at 57550000 "msiexec.exe" loaded module "%WINDIR%\System32\msvcp_win.dll" at 57970000 "msiexec.exe" loaded module "%WINDIR%\System32\ucrtbase.dll" at 57430000 "msiexec.exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 58460000 "msiexec.exe" loaded module "%WINDIR%\System32\combase.dll" at 594A0000 "msiexec.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 58AE0000 "msiexec.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 57090000 "msiexec.exe" loaded module "%WINDIR%\System32\winspool.drv" at 3AC60000 "msiexec.exe" loaded module "%WINDIR%\System32\IPHLPAPI.DLL" at 565A0000 "msiexec.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 56AE0000 "msiexec.exe" loaded module "%WINDIR%\System32\sfc.dll" at 1B600000 "msiexec.exe" loaded module "%WINDIR%\System32\sfc_os.dll" at 49DF0000 "msiexec.exe" loaded module "%WINDIR%\System32\imm32.dll" at 58D90000 "msiexec.exe" loaded module "%WINDIR%\System32\advapi32.dll" at 582B0000 "msiexec.exe" loaded module "%WINDIR%\System32\sechost.dll" at 58930000 "msiexec.exe" loaded module "%WINDIR%\System32\ole32.dll" at 58E70000 "msiexec.exe" loaded module "%WINDIR%\Temp\VxSSL64.dll" at 4FEA0000 "msiexec.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 58210000 "msiexec.exe" loaded module "%WINDIR%\System32\fltLib.dll" at 4E080000 "msiexec.exe" loaded module "%WINDIR%\Temp\VxOle64.dll" at 4E250000 "msiexec.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 58A10000 "msiexec.exe" loaded module "%WINDIR%\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7\comctl32.dll" at 47C40000 "msiexec.exe" loaded module "%WINDIR%\System32\msi.dll" at 3AEB0000 "msiexec.exe" loaded module "%WINDIR%\System32\shell32.dll" at 59820000 "msiexec.exe" loaded module "%WINDIR%\System32\cfgmgr32.dll" at 57110000 "msiexec.exe" loaded module "%WINDIR%\System32\SHCore.dll" at 1D0F0000 "msiexec.exe" loaded module "%WINDIR%\System32\windows.storage.dll" at 57A10000 "msiexec.exe" loaded module "%WINDIR%\System32\kernel.appcore.dll" at 57050000 "msiexec.exe" loaded module "%WINDIR%\System32\powrprof.dll" at 56FE0000 "msiexec.exe" loaded module "%WINDIR%\System32\profapi.dll" at 57070000 "msiexec.exe" loaded module "%WINDIR%\System32\srpapi.dll" at 44970000 "msiexec.exe" loaded module "%WINDIR%\System32\crypt32.dll" at 576F0000 "msiexec.exe" loaded module "%WINDIR%\System32\msasn1.dll" at 57030000 "msiexec.exe" loaded module "%WINDIR%\System32\coml2.dll" at 58990000 "msiexec.exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 555D0000 "msiexec.exe" loaded module "%WINDIR%\System32\msctf.dll" at 58C00000 "msiexec.exe" loaded module "%WINDIR%\System32\dwmapi.dll" at 55890000 "msiexec.exe" loaded module "%WINDIR%\System32\TextInputFramework.dll" at 4AFC0000 "msiexec.exe" loaded module "%WINDIR%\System32\CoreUIComponents.dll" at 53A50000 "msiexec.exe" loaded module "%WINDIR%\System32\CoreMessaging.dll" at 547A0000 "msiexec.exe" loaded module "%WINDIR%\System32\ntmarta.dll" at 56120000 "msiexec.exe" loaded module "%WINDIR%\System32\WinTypes.dll" at 53910000 "msiexec.exe" loaded module "%WINDIR%\System32\WinTypes.dll" at 1D740000 "msiexec.exe" loaded module "%WINDIR%\System32\propsys.dll" at 515B0000 "msiexec.exe" loaded module "%WINDIR%\System32\clbcatq.dll" at 583C0000 "msiexec.exe" loaded module "%WINDIR%\System32\netapi32.dll" at 4CCD0000 "msiexec.exe" loaded module "%WINDIR%\System32\samcli.dll" at 50CB0000 "msiexec.exe" loaded module "%WINDIR%\System32\wkscli.dll" at 51CB0000 "msiexec.exe" loaded module "%WINDIR%\System32\netutils.dll" at 566A0000 "msiexec.exe" loaded module "%WINDIR%\System32\wldp.dll" at 56010000 "msiexec.exe" loaded module "%WINDIR%\System32\wintrust.dll" at 573D0000 "msiexec.exe" loaded module "%WINDIR%\System32\cryptsp.dll" at 569D0000 "msiexec.exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 56420000 "msiexec.exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 569F0000 "msiexec.exe" loaded module "%WINDIR%\System32\msisip.dll" at 509D0000 "msiexec.exe" loaded module "%WINDIR%\System32\gpapi.dll" at 55DD0000 "msiexec.exe" loaded module "%WINDIR%\System32\cryptnet.dll" at 46CF0000 "msiexec.exe" loaded module "%WINDIR%\System32\winnsi.dll" at 51E30000 "msiexec.exe" loaded module "%WINDIR%\System32\nsi.dll" at 58D80000 "msiexec.exe" loaded module "%WINDIR%\System32\winhttp.dll" at 50CD0000 "msiexec.exe" loaded module "%WINDIR%\System32\mswsock.dll" at 56810000 "msiexec.exe" loaded module "%WINDIR%\System32\dhcpcsvc6.dll" at 51890000 "msiexec.exe" loaded module "%WINDIR%\System32\dhcpcsvc.dll" at 52190000 "msiexec.exe" loaded module "%WINDIR%\System32\webio.dll" at 4CFC0000 "msiexec.exe" loaded module "%WINDIR%\System32\sspicli.dll" at 56F10000 "msiexec.exe" loaded module "%WINDIR%\System32\dnsapi.dll" at 565E0000 "msiexec.exe" loaded module "%WINDIR%\System32\rasadhlp.dll" at 4F020000 "msiexec.exe" loaded module "%WINDIR%\System32\FWPUCLNT.DLL" at 50960000 "msiexec.exe" loaded module "%WINDIR%\System32\cabinet.dll" at 526E0000 "msiexec.exe" loaded module "%WINDIR%\System32\OnDemandConnRouteHelper.dll" at 44400000 "msiexec.exe" loaded module "%WINDIR%\System32\version.dll" at 52400000 "msiexec.exe" loaded module "%WINDIR%\System32\mscoree.dll" at 4E1E0000 "msiexec.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" at 4E130000 "msiexec.exe" loaded module "%WINDIR%\System32\msihnd.dll" at 4AAE0000 "msiexec.exe" loaded module "%WINDIR%\System32\pcacli.dll" at 4A560000 "msiexec.exe" loaded module "%WINDIR%\System32\mpr.dll" at 52410000 "msiexec.exe" loaded module "%WINDIR%\System32\WindowsCodecs.dll" at 53ED0000 "msiexec.exe" loaded module "%WINDIR%\System32\setupapi.dll" at 584C0000 "msiexec.exe" loaded module "%WINDIR%\System32\riched20.dll" at 4AA40000 "msiexec.exe" loaded module "%WINDIR%\System32\usp10.dll" at 50120000 "msiexec.exe" loaded module "%WINDIR%\System32\msls31.dll" at 4B1A0000 "msiexec.exe" loaded module "%WINDIR%\System32\sfc.dll" at 230E0000 "msiexec.exe" loaded module "%WINDIR%\System32\SHCore.dll" at 23D20000 "msiexec.exe" loaded module "%WINDIR%\System32\userenv.dll" at 56EE0000 "msiexec.exe" loaded module "%WINDIR%\System32\srclient.dll" at 503A0000 "msiexec.exe" loaded module "%WINDIR%\System32\spp.dll" at 4E350000 "msiexec.exe" loaded module "%WINDIR%\System32\vssapi.dll" at 4B5C0000 "msiexec.exe" loaded module "%WINDIR%\System32\vsstrace.dll" at 4BA10000 "msiexec.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\fusion.dll" at 50380000 "msiexec.exe" loaded module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" at 38670000 "msiexec.exe" loaded module "%WINDIR%\System32\vcruntime140_clr0400.dll" at 4FD40000 "msiexec.exe" loaded module "%WINDIR%\System32\ucrtbase_clr0400.dll" at 3A820000 "msiexec.exe" loaded module "%WINDIR%\System32\ucrtbase_clr0400.dll" at 268B0000 "msiexec.exe" loaded module "%WINDIR%\System32\RstrtMgr.dll" at 4E310000 "msiexec.exe" loaded module "%WINDIR%\System32\ncrypt.dll" at 56AB0000 "msiexec.exe" loaded module "%WINDIR%\System32\ntasn1.dll" at 56A70000 "msiexec.exe" loaded module "%WINDIR%\System32\cldapi.dll" at 477F0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\msiexec.exe" at 008F0000 "MsiExec.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 5AC90000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77B30000 "MsiExec.exe" loaded module "%WINDIR%\System32\wow64.dll" at 652A0000 "MsiExec.exe" loaded module "%WINDIR%\System32\wow64win.dll" at 65300000 "MsiExec.exe" loaded module "%WINDIR%\System32\user32.dll" at 02E10000 "MsiExec.exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 65380000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 75F10000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 76530000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\apphelp.dll" at 744A0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\AcLayers.dll" at 72A80000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 74850000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 77890000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 76D40000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 74640000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 746F0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 74670000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 77A10000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\shell32.dll" at 74910000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\cfgmgr32.dll" at 745D0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\SHCore.dll" at 76070000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 774B0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 74550000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 74540000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74570000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 770B0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 77260000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\windows.storage.dll" at 76770000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 777A0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\shlwapi.dll" at 76FE0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\kernel.appcore.dll" at 77880000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\powrprof.dll" at 77750000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\profapi.dll" at 75E50000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 75E70000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\setupapi.dll" at 76100000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\mpr.dll" at 74450000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\winspool.drv" at 72A10000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\IPHLPAPI.DLL" at 74470000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 72F60000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\sfc.dll" at 00BF0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\sfc_os.dll" at 739D0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 74610000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 77650000 "MsiExec.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 729C0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 76ED0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 74280000 "MsiExec.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 72970000 "MsiExec.exe" loaded module "%WINDIR%\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\comctl32.dll" at 73510000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\clbcatq.dll" at 76F40000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\msi.dll" at 72580000 "MsiExec.exe" loaded module "\Users\%OSUSER%\AppData\Local\Temp\MSI47E9.tmp" at 72560000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\version.dll" at 73FA0000 "MsiExec.exe" loaded module "\Users\%OSUSER%\AppData\Local\Temp\MSI2F7E.tmp" at 71F20000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\crypt32.dll" at 75C50000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\msasn1.dll" at 76760000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\comdlg32.dll" at 77570000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\msimg32.dll" at 71F10000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\winhttp.dll" at 71E60000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\uxtheme.dll" at 73D80000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\msctf.dll" at 77110000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\dwmapi.dll" at 730F0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\DataExchange.dll" at 71E10000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\d3d11.dll" at 71BD0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\dcomp.dll" at 71AD0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\dxgi.dll" at 71A30000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\twinapi.appcore.dll" at 718F0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\rmclient.dll" at 718D0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\WindowsCodecs.dll" at 733A0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\TextInputFramework.dll" at 71850000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\CoreUIComponents.dll" at 71610000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\ntmarta.dll" at 73240000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\CoreMessaging.dll" at 73040000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\WinTypes.dll" at 71540000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\CoreMessaging.dll" at 06970000 "MsiExec.exe" loaded module "%WINDIR%\System32\user32.dll" at 032E0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\sfc.dll" at 03270000 "MsiExec.exe" loaded module "%WINDIR%\Installer\MSIB84D.tmp" at 72540000 "MsiExec.exe" loaded module "%WINDIR%\Installer\MSI85C.tmp" at 72560000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\wbem\wbemprox.dll" at 71E50000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\wbemcomn.dll" at 71DE0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\wbem\wbemsvc.dll" at 71DD0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\wbem\fastprox.dll" at 71D10000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\OnDemandConnRouteHelper.dll" at 71CF0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\webio.dll" at 71C90000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\mswsock.dll" at 71C30000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\winnsi.dll" at 71C20000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\nsi.dll" at 76FD0000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\dnsapi.dll" at 71B80000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\rasadhlp.dll" at 71B70000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\FWPUCLNT.DLL" at 71B20000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\schannel.dll" at 71AB0000 "MsiExec.exe" loaded module "%WINDIR%\Installer\MSI15BD.tmp" at 71F20000 "MsiExec.exe" loaded module "%WINDIR%\System32\msiexec.exe" at C0EF0000 "MsiExec.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 58DC0000 "MsiExec.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at 57160000 "MsiExec.exe" loaded module "%WINDIR%\System32\apphelp.dll" at 553E0000 "MsiExec.exe" loaded module "%WINDIR%\System32\AcLayers.dll" at 39140000 "MsiExec.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at 58FC0000 "MsiExec.exe" loaded module "%WINDIR%\System32\user32.dll" at 59310000 "MsiExec.exe" loaded module "%WINDIR%\System32\win32u.dll" at 57530000 "MsiExec.exe" loaded module "%WINDIR%\System32\gdi32.dll" at 58280000 "MsiExec.exe" loaded module "%WINDIR%\System32\gdi32full.dll" at 57550000 "MsiExec.exe" loaded module "%WINDIR%\System32\msvcp_win.dll" at 57970000 "MsiExec.exe" loaded module "%WINDIR%\System32\ucrtbase.dll" at 57430000 "MsiExec.exe" loaded module "%WINDIR%\System32\shlwapi.dll" at 58460000 "MsiExec.exe" loaded module "%WINDIR%\System32\combase.dll" at 594A0000 "MsiExec.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at 58AE0000 "MsiExec.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 57090000 "MsiExec.exe" loaded module "%WINDIR%\System32\winspool.drv" at 3AC60000 "MsiExec.exe" loaded module "%WINDIR%\System32\IPHLPAPI.DLL" at 565A0000 "MsiExec.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 56AE0000 "MsiExec.exe" loaded module "%WINDIR%\System32\sfc.dll" at FE5D0000 "MsiExec.exe" loaded module "%WINDIR%\System32\sfc_os.dll" at 49DF0000 "MsiExec.exe" loaded module "%WINDIR%\System32\imm32.dll" at 58D90000 "MsiExec.exe" loaded module "%WINDIR%\System32\advapi32.dll" at 582B0000 "MsiExec.exe" loaded module "%WINDIR%\System32\sechost.dll" at 58930000 "MsiExec.exe" loaded module "%WINDIR%\System32\ole32.dll" at 58E70000 "MsiExec.exe" loaded module "%WINDIR%\Temp\VxSSL64.dll" at 4FEA0000 "MsiExec.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at 58210000 "MsiExec.exe" loaded module "%WINDIR%\System32\fltLib.dll" at 4E080000 "MsiExec.exe" loaded module "%WINDIR%\Temp\VxOle64.dll" at 4E250000 "MsiExec.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at 58A10000 "MsiExec.exe" loaded module "%WINDIR%\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_15ced204935f55d7\comctl32.dll" at 47C40000 "MsiExec.exe" loaded module "%WINDIR%\System32\kernel.appcore.dll" at 57050000 "MsiExec.exe" loaded module "%WINDIR%\System32\clbcatq.dll" at 583C0000 "MsiExec.exe" loaded module "%WINDIR%\System32\msi.dll" at 3AEB0000 "MsiExec.exe" loaded module "%WINDIR%\System32\shell32.dll" at 59820000 "MsiExec.exe" loaded module "%WINDIR%\System32\cfgmgr32.dll" at 57110000 "MsiExec.exe" loaded module "%WINDIR%\System32\SHCore.dll" at 80070000 "MsiExec.exe" loaded module "%WINDIR%\System32\windows.storage.dll" at 57A10000 "MsiExec.exe" loaded module "%WINDIR%\System32\powrprof.dll" at 56FE0000 "MsiExec.exe" loaded module "%WINDIR%\System32\profapi.dll" at 57070000 "MsiExec.exe" loaded module "%WINDIR%\Installer\MSI986.tmp" at 47480000 "MsiExec.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 02E30000 "MsiExec.exe" loaded module "%WINDIR%\System32\user32.dll" at 02F50000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\sfc.dll" at 02F10000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\taskschd.dll" at 73760000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\xmllite.dll" at 73730000 "MsiExec.exe" loaded module "%WINDIR%\Installer\MSIEB0D.tmp" at 72540000 "reg.exe" loaded module "%WINDIR%\SysWOW64\reg.exe" at 00980000 "reg.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 5AC90000 "reg.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77B30000 "reg.exe" loaded module "%WINDIR%\System32\wow64.dll" at 652A0000 "reg.exe" loaded module "%WINDIR%\System32\wow64win.dll" at 65300000 "reg.exe" loaded module "%WINDIR%\System32\user32.dll" at 00430000 "reg.exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 65380000 "reg.exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 75F10000 "reg.exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 76530000 "reg.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 74850000 "reg.exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 777A0000 "reg.exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 770B0000 "reg.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 774B0000 "reg.exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 74550000 "reg.exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 74540000 "reg.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74570000 "reg.exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 76ED0000 "reg.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 729C0000 "reg.exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 74280000 "reg.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 77A10000 "reg.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 72970000 "reg.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 77890000 "reg.exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 76D40000 "reg.exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 74640000 "reg.exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 746F0000 "reg.exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 74670000 "reg.exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 77650000 "reg.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 77260000 "reg.exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 75E70000 "reg.exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 74610000 "reg.exe" loaded module "%WINDIR%\System32\user32.dll" at 02E10000 "reg.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 00B30000 "reg.exe" loaded module "%WINDIR%\System32\user32.dll" at 02F30000 "WerFault.exe" loaded module "%WINDIR%\SysWOW64\WerFault.exe" at 013D0000 "WerFault.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 5AC90000 "WerFault.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77B30000 "reg.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 00800000 "reg.exe" loaded module "%WINDIR%\System32\user32.dll" at 029F0000 "reg.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 02E70000 "reg.exe" loaded module "%WINDIR%\System32\user32.dll" at 02FB0000 "MsiExec.exe" loaded module "%WINDIR%\System32\sfc.dll" at 8BA00000 "MsiExec.exe" loaded module "%WINDIR%\System32\SHCore.dll" at 8D280000 "MsiExec.exe" loaded module "%WINDIR%\Installer\MSIFBA8.tmp" at 3AD80000 "MsiExec.exe" loaded module "%WINDIR%\System32\setupapi.dll" at 584C0000 "MsiExec.exe" loaded module "%WINDIR%\System32\wintrust.dll" at 573D0000 "MsiExec.exe" loaded module "%WINDIR%\System32\msasn1.dll" at 57030000 "MsiExec.exe" loaded module "%WINDIR%\System32\crypt32.dll" at 576F0000 "MsiExec.exe" loaded module "%WINDIR%\System32\uxtheme.dll" at 555D0000 "MsiExec.exe" loaded module "%WINDIR%\System32\devrtl.dll" at 50380000 "MsiExec.exe" loaded module "%WINDIR%\System32\spinf.dll" at 4DE30000 "MsiExec.exe" loaded module "%WINDIR%\System32\drvstore.dll" at 3A160000 "MsiExec.exe" loaded module "%WINDIR%\System32\cryptsp.dll" at 569D0000 "MsiExec.exe" loaded module "%WINDIR%\System32\rsaenh.dll" at 56420000 "MsiExec.exe" loaded module "%WINDIR%\System32\cryptbase.dll" at 569F0000 "MsiExec.exe" loaded module "%WINDIR%\System32\ntmarta.dll" at 56120000 "MsiExec.exe" loaded module "%WINDIR%\System32\spfileq.dll" at 4FD20000 "MsiExec.exe" loaded module "%WINDIR%\System32\cabinet.dll" at 526E00005c:T30d8,"msiexec.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 57160000 "msiexec.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 57160000 "msiexec.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 57160000 "msiexec.exe" loaded module "KERNEL32" at base 58dc0000 "msiexec.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 4e250000 "msiexec.exe" loaded module "COMCTL32" at base 47c40000 "msiexec.exe" loaded module "KERNEL32.DLL" at base 58dc0000 "msiexec.exe" loaded module "COMCTL32.DLL" at base 47c40000 "msiexec.exe" loaded module "SRPAPI.DLL" at base 44970000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\TSAPPCMP.DLL" at base 0 "msiexec.exe" loaded module "NTDLL.DLL" at base 5ac90000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 58460000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 58e70000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 58dc0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 555d0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 58c00000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 59820000 "msiexec.exe" loaded module "SHELL32.DLL" at base 59820000 "msiexec.exe" loaded module "OLEAUT32.DLL" at base 58a10000 "msiexec.exe" loaded module "RPCRT4.DLL" at base 58ae0000 "msiexec.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 59310000 "msiexec.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 59310000 "msiexec.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 594a0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\NETAPI32.DLL" at base 4ccd0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\WLDP.DLL" at base 56010000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 582b0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 573d0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 56420000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 509d0000 "msiexec.exe" loaded module "OLE32.DLL" at base 58e70000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 576f0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 57090000 "msiexec.exe" loaded module "ADVAPI32.DLL" at base 582b0000 "msiexec.exe" loaded module "CRYPT32.DLL" at base 576f0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 46cf0000 "msiexec.exe" loaded module "CRYPTNET.DLL" at base 46cf0000 "msiexec.exe" loaded module "WINHTTP.DLL" at base 50cd0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 44400000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 56810000 "msiexec.exe" loaded module "SSPICLI.DLL" at base 56f10000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 4f020000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 50960000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 3aeb0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 553e0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 52400000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 4e1e0000 "msiexec.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 4e130000 "msiexec.exe" loaded module "SHLWAPI.DLL" at base 58460000 "msiexec.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 57050000 "msiexec.exe" loaded module "VERSION.DLL" at base 52400000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\NTDLL.DLL" at base 5ac90000 "msiexec.exe" loaded module "MSIHND.DLL" at base 4aae0000 "msiexec.exe" loaded module "DWMAPI" at base 55890000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\PCACLI.DLL" at base 4a560000 "msiexec.exe" loaded module "USER32" at base 59310000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 53ed0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 1b600000 "msiexec.exe" loaded module "RICHED20.DLL" at base 4aa40000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\USER32.DLL" at base 59310000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RPCRT4.DLL" at base 58ae0000 "msiexec.exe" loaded module "MSI.DLL" at base 3aeb0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 56ee0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SRCLIENT.DLL" at base 503a0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SPP.DLL" at base 4e350000 "msiexec.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\FUSION.DLL" at base 50380000 "msiexec.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 38670000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 4e310000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 230e0000 "msiexec.exe" loaded module "CABINET" at base 526e0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 57a10000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 515b0000 "msiexec.exe" loaded module "%WINDIR%\SYSTEM32\KERNELBASE.DLL" at base 57160000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76530000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76530000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76530000 "MsiExec.exe" loaded module "KERNEL32" at base 75f10000 "MsiExec.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72970000 "MsiExec.exe" loaded module "COMCTL32" at base 73510000 "MsiExec.exe" loaded module "KERNEL32.DLL" at base 75f10000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\OLE32.DLL" at base 77650000 "MsiExec.exe" loaded module "RPCRT4.DLL" at base 774b0000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\MSI.DLL" at base 72580000 "MsiExec.exe" loaded module "MSI.DLL" at base 72580000 "MsiExec.exe" loaded module "COMCTL32.DLL" at base 73510000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\RPCRT4.DLL" at base 774b0000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\ADVAPI32.DLL" at base 777a0000 "MsiExec.exe" loaded module "ADVAPI32" at base 777a0000 "MsiExec.exe" loaded module "%TEMP%\MSI47E9.TMP" at base 72560000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\KERNEL32.DLL" at base 75f10000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\USER32.DLL" at base 77890000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 76530000 "MsiExec.exe" loaded module "%TEMP%\MSI1750.TMP" at base 71f20000 "MsiExec.exe" loaded module "%TEMP%\MSI1974.TMP" at base 71f20000 "MsiExec.exe" loaded module "%TEMP%\MSI2F7E.TMP" at base 71f20000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73d80000 "MsiExec.exe" loaded module "NTDLL.DLL" at base 77b30000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76530000 "MsiExec.exe" loaded module "UXTHEME.DLL" at base 73d80000 "MsiExec.exe" loaded module "GDI32.DLL" at base 74640000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 71e10000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74910000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77110000 "MsiExec.exe" loaded module "OLEAUT32.DLL" at base 75e70000 "MsiExec.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 77890000 "MsiExec.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 77890000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 77260000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 77650000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSI8ABF.TMP" at base 72540000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIADBA.TMP" at base 72560000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIB26F.TMP" at base 72540000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIB500.TMP" at base 72540000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIB84D.TMP" at base 72540000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSI85C.TMP" at base 72560000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIBC9.TMP" at base 71f20000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76530000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 71e50000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 71dd0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 71d10000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 76530000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 76530000 "MsiExec.exe" loaded module "WINHTTP.DLL" at base 71e60000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71cf0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 71c30000 "MsiExec.exe" loaded module "SSPICLI.DLL" at base 74550000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 71b70000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71b20000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 71ab0000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSI15BD.TMP" at base 71f20000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 57160000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 57160000 "MsiExec.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 57160000 "MsiExec.exe" loaded module "KERNEL32" at base 58dc0000 "MsiExec.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 4e250000 "MsiExec.exe" loaded module "COMCTL32" at base 47c40000 "MsiExec.exe" loaded module "KERNEL32.DLL" at base 58dc0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 58e70000 "MsiExec.exe" loaded module "RPCRT4.DLL" at base 58ae0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\MSI.DLL" at base 3aeb0000 "MsiExec.exe" loaded module "MSI.DLL" at base 3aeb0000 "MsiExec.exe" loaded module "COMCTL32.DLL" at base 47c40000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\RPCRT4.DLL" at base 58ae0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 582b0000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIAE47.TMP" at base 47480000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 58dc0000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSI986.TMP" at base 47480000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSICBE7.TMP" at base 72540000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSID9B3.TMP" at base 72540000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIDF42.TMP" at base 72540000 "MsiExec.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 73760000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIE02D.TMP" at base 72540000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIE118.TMP" at base 72540000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIE501.TMP" at base 72540000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIEB0D.TMP" at base 72540000 "reg.exe" loaded module "KERNEL32" at base 75f10000 "reg.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76530000 "reg.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76530000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76530000 "reg.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74610000 "reg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76530000 "reg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76530000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76530000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72970000 "reg.exe" loaded module "KERNEL32.DLL" at base 75f10000 "MsiExec.exe" loaded module "%WINDIR%\INSTALLER\MSIFBA8.TMP" at base 3ad80000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 555d0000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 56420000 "MsiExec.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 57090000 "MsiExec.exe" loaded module "CABINET.DLL" at base 526e0000 "MsiExec.exe" loaded module "SETUPAPI.DLL" at base 584c00005d:Td08,"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin" was detected as "Microsoft Installer(MSI)" and name: "Installer" "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin" was detected as "Microsoft Compound" and name: "Data" "Qt5Core.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "Qt5Core.dll" was detected as "Microsoft Compound" and name: "Data" "paragon_service.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "paragon_service.exe" was detected as "Microsoft Compound" and name: "Data" "cygwin1.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "cygwin1.dll" was detected as "Microsoft Compound" and name: "Data" "Linux File Systems for Windows by Paragon Software.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "Linux File Systems for Windows by Paragon Software.exe" was detected as "Microsoft Compound" and name: "Data" "fsdump.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "fsdump.exe" was detected as "Microsoft Compound" and name: "Data" "Updater.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "Updater.exe" was detected as "Microsoft Compound" and name: "Data" "qwindows.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "qwindows.dll" was detected as "Microsoft Compound" and name: "Data" "e2fsck.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "e2fsck.exe" was detected as "Microsoft Compound" and name: "Data" "msvcp140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" was detected as "Microsoft Installer(MSI)" and name: "Installer" "msvcp140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" was detected as "Microsoft Compound" and name: "Data" "mke2fs.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "mke2fs.exe" was detected as "Microsoft Compound" and name: "Data" "dokan.dll" was detected as "Microsoft Installer(MSI)" and name: "Installer" "dokan.dll" was detected as "Microsoft Compound" and name: "Data" "vcamp140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" was detected as "Microsoft Installer(MSI)" and name: "Installer" "vcamp140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" was detected as "Microsoft Compound" and name: "Data" "extmounter.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "extmounter.exe" was detected as "Microsoft Compound" and name: "Data" "vccorlib140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" was detected as "Microsoft Installer(MSI)" and name: "Installer" "vccorlib140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" was detected as "Microsoft Compound" and name: "Data" "concrt140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" was detected as "Microsoft Installer(MSI)" and name: "Installer" "concrt140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" was detected as "Microsoft Compound" and name: "Data" "mfcm140u.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" was detected as "Microsoft Installer(MSI)" and name: "Installer" "mfcm140u.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" was detected as "Microsoft Compound" and name: "Data" "mklost_found.exe" was detected as "Microsoft Installer(MSI)" and name: "Installer" "mklost_found.exe" was detected as "Microsoft Compound" and name: "Data"5e:T2725,"SELECT `Text` FROM `Control` WHERE `Control`='LicenseText'" (Source: 9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin, Indicator: "select `text` from `control` where `control`='licensetext'") "SELECT `Action`,NULL,`Condition` FROM `InstallExecuteSequence` WHERE `Sequence` > 0 ORDER BY `Sequence`" (Source: 00000000-00000736.00000002.82905.14B63000.00000004.mdmp, 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `action`,null,`condition` from `installexecutesequence` where `sequence` > 0 order by `sequence`") "SELECT `ComponentId`, `BinaryType`, `Action` From `Component` WHERE (`Component_Parent` = null OR `Component_Parent` = `Component`) AND `ComponentId` <> null AND (`ActionRequest` = 0)" (Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp, Indicator: "select `componentid`, `binarytype`, `action` from `component` where (`component_parent` = null or `component_parent` = `component`) and `componentid` <> null and (`actionrequest` = 0)"), "SELECT * FROM #_MsiRedirectedFile WHERE `Sequence` IS NOT NULL ORDER BY `Sequence`" (Source: 00000000-00000736.00000002.82905.23110000.00000004.mdmp, Indicator: "select * from #_msiredirectedfile where `sequence` is not null order by `sequence`"), "SELECT `Patch`.`File_` `Patch`.`Header` `Patch`.`Attributes` `Patch`.`Sequence` `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `patch`.`file_` `patch`.`header` `patch`.`attributes` `patch`.`sequence` `patch`.`streamref_` from `patch` where `patch`.`file_` = ? and `patch`.`#_msiactive`=? order by `patch`.`sequence`"), "SELECT `DiskId` `PatchId` `LastSequence` FROM `Media` `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId`" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `diskid` `patchid` `lastsequence` from `media` `patchpackage` where `media`.`diskid`=`patchpackage`.`media_` order by `diskid`"), "SELECT `Root` `Key` `Name` `Value` FROM `Registry` `Component` WHERE `Registry`=? AND `Registry`.`Component_` = `Component`.`Component`" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `root` `key` `name` `value` from `registry` `component` where `registry`=? and `registry`.`component_` = `component`.`component`"), "SELECT `Name` `Value` FROM `Environment` `Component` WHERE `Component_`=`Component` AND (`Component`.`Action` = 1 OR `Component`.`Action` = 2)" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `name` `value` from `environment` `component` where `component_`=`component` and (`component`.`action` = 1 or `component`.`action` = 2)"), "SELECT `File`.`File` `File`.`FileName` `Component`.`Directory_` `Component`.`Attributes` `Component`.`KeyPath` `Component`.`ActionRequest` `BinaryType` FROM `File` `Component` WHERE `File`.`Component_` = `Component`.`Component` AND `Component`.`Component` = ?" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `file`.`file` `file`.`filename` `component`.`directory_` `component`.`attributes` `component`.`keypath` `component`.`actionrequest` `binarytype` from `file` `component` where `file`.`component_` = `component`.`component` and `component`.`component` = ?"), "SELECT `Feature` `Feature_Parent` FROM `Feature` WHERE (`Feature`.`Installed` = null OR `Feature`.`Installed` = 0) AND (`Feature`.`Action` = null OR `Feature`.`Action` = 0 OR `Feature`.`Action` = 3) AND `Feature`.`RuntimeLevel` > 0" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `feature` `feature_parent` from `feature` where (`feature`.`installed` = null or `feature`.`installed` = 0) and (`feature`.`action` = null or `feature`.`action` = 0 or `feature`.`action` = 3) and `feature`.`runtimelevel` > 0"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'MsiRollbackInstall'" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'msirollbackinstall'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'SetWindowsOsName'" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'setwindowsosname'"), "SELECT `FileName` `Version` `State` `File`.`Attributes` `TempAttributes` `File` `FileSize` `Language` `Sequence` `Directory_` `Installed` `Action` `Component` `ForceLocalFiles` `ComponentId` NULL FROM `File` `Component` WHERE `Component`=`Component_` AND `File`=?" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `filename` `version` `state` `file`.`attributes` `tempattributes` `file` `filesize` `language` `sequence` `directory_` `installed` `action` `component` `forcelocalfiles` `componentid` null from `file` `component` where `component`=`component_` and `file`=?"), "SELECT `ComponentId` FROM `FeatureComponents` `Component` WHERE `Component` = `Component_` AND `Feature_` = ?" (Source: 00000000-00000736.00000002.82905.264C0000.00000004.mdmp, Indicator: "select `componentid` from `featurecomponents` `component` where `component` = `component_` and `feature_` = ?"), "SELECT `Feature` `Feature_Parent` FROM `Feature` WHERE ((`Feature`.`Action` = 1 OR `Feature`.`Action` = 2) OR (`Feature`.`Action` = 4 AND `Feature`.`Installed` = 0) OR (`Feature`.`Action` = 3 AND (`Feature`.`Installed` = 1 OR `Feature`.`Installed` = 2 OR `Feature`.`Installed` = 4)))" (Source: 00000000-00000736.00000002.82905.265A9000.00000004.mdmp, Indicator: "select `feature` `feature_parent` from `feature` where ((`feature`.`action` = 1 or `feature`.`action` = 2) or (`feature`.`action` = 4 and `feature`.`installed` = 0) or (`feature`.`action` = 3 and (`feature`.`installed` = 1 or `feature`.`installed` = 2 or `feature`.`installed` = 4)))"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'QtExecLocalCrashDumpFolder'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'qtexeclocalcrashdumpfolder'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'QtExecImportOldProperties'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'qtexecimportoldproperties'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'MsiInstallDrivers64'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'msiinstalldrivers64'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'MsiRollbackInstall64'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'msirollbackinstall64'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'LocalCrashDumpCount'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'localcrashdumpcount'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'MsiProcessDrivers64'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'msiprocessdrivers64'"), "SELECT `Action` `Type` `Source` `Target` NULL `ExtendedType` FROM `CustomAction` WHERE `Action` = 'AddScheduledUpdaterTask'" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `action` `type` `source` `target` null `extendedtype` from `customaction` where `action` = 'addscheduledupdatertask'"), "SELECT `Patch`.`Sequence` `Patch`.`PatchSize` `Patch`.`Attributes` `Patch`.`Header` `Patch`.`StreamRef_` FROM `File` `Patch` `Component` WHERE `File`=? AND `File`=`File_` AND `Component`=`Component_` ORDER BY `Patch`.`Sequence`" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `patch`.`sequence` `patch`.`patchsize` `patch`.`attributes` `patch`.`header` `patch`.`streamref_` from `file` `patch` `component` where `file`=? and `file`=`file_` and `component`=`component_` order by `patch`.`sequence`"), "SELECT `Patch`.`Sequence` `Patch`.`PatchSize` `Patch`.`Attributes` `Patch`.`Header` `Patch`.`StreamRef_` FROM `File` `Pa0" (Source: 00000000-00000736.00000002.82905.268B0000.00000004.mdmp, Indicator: "select `patch`.`sequence` `patch`.`patchsize` `patch`.`attributes` `patch`.`header` `patch`.`streamref_` from `file` `pa0"), "SELECT `FileName` `Version` `State` `File`.`Attributes` `TempAttributes` `File` `FileSize` `Language` `Sequence` `Directory_` `Installed` `Action` `Component` FROM `File` `Component` WHERE `Component`=`Component_` AND `Component_`=? AND `Directory_`=?" (Source: 00000000-00000736.00000002.82905.288B0000.00000004.mdmp, Indicator: "select `filename` `version` `state` `file`.`attributes` `tempattributes` `file` `filesize` `language` `sequence` `directory_` `installed` `action` `component` from `file` `component` where `component`=`component_` and `component_`=? and `directory_`=?")5f:Tb42,Observed system executable string:"%WINDIR%\system32\TSAPPCMP.DLL" [Source: 00000000-00006356-00000C1E-73720024] Observed system executable string:"%WINDIR%\system32\SHLWAPI.DLL" [Source: 00000000-00006356-00000C1E-73757977] Observed system executable string:"%WINDIR%\system32\OLE32.DLL" [Source: 00000000-00006356-00000C1E-73801640] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00006356-00000C1E-73860702] Observed system executable string:"%WINDIR%\system32\SHELL32.DLL" [Source: 00000000-00006356-00000C1E-73980682] Observed system executable string:"%WINDIR%\system32\NETAPI32.DLL" [Source: 00000000-00006356-00000C1E-74217387] Observed system executable string:"%WINDIR%\system32\WLDP.DLL" [Source: 00000000-00006356-00000C1E-74744862] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00006356-00000C1E-74780686] Observed system executable string:"%WINDIR%\system32\APPHELP.DLL" [Source: 00000000-00006356-00000C1E-79910521] Observed system executable string:"%WINDIR%\system32\VERSION.DLL" [Source: 00000000-00006356-00000C1E-80118296] Observed system executable string:"%WINDIR%\system32\sxs.DLL" [Source: 00000000-00006356-00000C1E-80141961] Observed system executable string:"%WINDIR%\system32\MSCOREE.DLL" [Source: 00000000-00006356-00000C1E-80213701] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00006356-00000C1E-80448803] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\fusion.dll" [Source: 00000000-00006356-00000C1E-80612034] Observed system executable string:"%WINDIR%\system32\NTDLL.DLL" [Source: 00000000-00006356-00000C1E-80854821] Observed system executable string:"%WINDIR%\system32\PCACLI.DLL" [Source: 00000000-00006356-00000C1E-81488658] Observed system executable string:"%WINDIR%\SysWOW64\advapi32.dll" [Source: 00000000-00006356-00000C1E-82140024] Observed system executable string:"%WINDIR%\system32\SFC.DLL" [Source: 00000000-00006356-00000C1E-82302152] Observed system executable string:"%WINDIR%\SysWOW64\mfc140rus.dll" [Source: 00000000-00006356-00000C1E-82367592] Observed system executable string:"%WINDIR%\SysWOW64\mfc140kor.dll" [Source: 00000000-00006356-00000C1E-82567980] Observed system executable string:"%WINDIR%\SysWOW64\mfc140jpn.dll" [Source: 00000000-00006356-00000C1E-82597058] Observed system executable string:"%WINDIR%\SysWOW64\mfc140ita.dll" [Source: 00000000-00006356-00000C1E-82624969] Observed system executable string:"%WINDIR%\SysWOW64\mfc140fra.dll" [Source: 00000000-00006356-00000C1E-82652271] Observed system executable string:"%WINDIR%\SysWOW64\mfc140esn.dll" [Source: 00000000-00006356-00000C1E-82677718] Observed system executable string:"%WINDIR%\SysWOW64\mfc140enu.dll" [Source: 00000000-00006356-00000C1E-82719417]60:T405,"Qt5Core.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Linux File Systems for Windows by Paragon Software.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "Updater.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "qwindows.dll" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "msvcp140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "vcamp140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "extmounter.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "vccorlib140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "concrt140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "mfcm140u.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE61:T460,Found reference to API "RegisterServiceCtrlHandler failed." (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "RegisterServiceCtrlHandler failed." (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "RegisterServiceCtrlHandlerW" (Indicator: "RegisterServiceCtrlHandler"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")62:T5d0,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")63:T908,"MSI9416.tmp" has type "data" - Location: [%WINDIR%\Installer\MSI9416.tmp] "MSIFBA8.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" - Location: [%WINDIR%\Installer\MSIFBA8.tmp] "MSIDF42.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSIDF42.tmp] "MSICBE7.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSICBE7.tmp] "MSI986.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" - Location: [%WINDIR%\Installer\MSI986.tmp] "MSI47E9.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%TEMP%\MSI47E9.tmp] "SET3D7.tmp" has type "PE32+ executable (native) x86-64 for MS Windows" - Location: [%WINDIR%\System32\drivers\SET3D7.tmp] "MSIB26F.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSIB26F.tmp] "MSIB84D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSIB84D.tmp] "MSI8ABF.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSI8ABF.tmp] "MSIE02D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSIE02D.tmp] "MSID9B3.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSID9B3.tmp] "MSIE501.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSIE501.tmp] "MSIEB0D.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSIEB0D.tmp] "MSIE118.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSIE118.tmp] "MSIAE47.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" - Location: [%WINDIR%\Installer\MSIAE47.tmp] "MSIB500.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSIB500.tmp] "MSIADBA.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSIADBA.tmp] "MSI85C.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" - Location: [%WINDIR%\Installer\MSI85C.tmp]64:T1b49,"msiexec.exe" reads file "c:\windows\fonts\staticcache.dat" "msiexec.exe" reads file "c:\setup.msi" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_178c086b699fd6c56b804af3ef759cb5" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_178c086b699fd6c56b804af3ef759cb5" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_ab5eaaa21df673505b87d680ac76b6e1" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_ab5eaaa21df673505b87d680ac76b6e1" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\782d7e2bfb036a849a99ffa65c652d39" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\782d7e2bfb036a849a99ffa65c652d39" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\616ad1ab067cfd351d6c0ef6f3e12f40" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\616ad1ab067cfd351d6c0ef6f3e12f40" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\66ae3bfdf94a732b262342ad2154b86e_2f4e03f10a4a01edf8dd2fcaf5862404" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\66ae3bfdf94a732b262342ad2154b86e_2f4e03f10a4a01edf8dd2fcaf5862404" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\66ae3bfdf94a732b262342ad2154b86e_1c72b0d0b477924e3f62d28a4d4fdf1f" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\66ae3bfdf94a732b262342ad2154b86e_1c72b0d0b477924e3f62d28a4d4fdf1f" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\0e506cebbc8b162cfb2d72db4891dcae" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\0e506cebbc8b162cfb2d72db4891dcae" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\f4ea555947766f67c3bb52dedfd509c5" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\f4ea555947766f67c3bb52dedfd509c5" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_38924edf39d8802d6946fb22e5dd0835" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_38924edf39d8802d6946fb22e5dd0835" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_caf45fdc3736d8d4b3a07d258cec8d47" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_caf45fdc3736d8d4b3a07d258cec8d47" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\fc68fb72d4fbc7e0f151bc2282d75e47_367fa2447481c3db640ce44be2e5a181" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\fc68fb72d4fbc7e0f151bc2282d75e47_367fa2447481c3db640ce44be2e5a181" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\fc68fb72d4fbc7e0f151bc2282d75e47_eb1c5e06bf3344f593ede146b267d980" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\fc68fb72d4fbc7e0f151bc2282d75e47_eb1c5e06bf3344f593ede146b267d980" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\4d8404427a196184a4b981c5ccda3643" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\4d8404427a196184a4b981c5ccda3643" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\72eef18e0160f79a0810e7ae28bbcbac" "msiexec.exe" reads file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\72eef18e0160f79a0810e7ae28bbcbac" "msiexec.exe" reads file "c:\windows\win.ini" "msiexec.exe" reads file "c:\windows\installer\137032.msi" "msiexec.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\ngen.log" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\000041091a0090400100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109340000000100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109340090400100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109510090400100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109610090400100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109810090400100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109a10090400100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109ab0090400100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109b10090400100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109e60090400100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109f10090400100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109f100a0c00100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004109f100c0400100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\00004119110000000100000000f01fec\cachesize.txt" "msiexec.exe" reads file "c:\windows\installer\$patchcache$\managed\68ab67ca7da73301b744ba0000000010\cachesize.txt" "MsiExec.exe" reads file "c:\users\%osuser%\appdata\local\temp\lang\en\lang.mo" "MsiExec.exe" reads file "c:\users\%osuser%\appdata\local\iconcache.db" "MsiExec.exe" reads file "c:\windows\fonts\staticcache.dat" "MsiExec.exe" reads file "c:\users\%osuser%\appdata\local\temp\dokandrv10x64\dokan.inf" "MsiExec.exe" reads file "c:\users\%osuser%\appdata\local\temp\dokandrv10x64\dokan.cat" "MsiExec.exe" reads file "c:\users\%osuser%\appdata\local\temp\dokandrv10x64\dokan.sys" "MsiExec.exe" reads file "c:\windows\system32\drvstore\dokan_03786891cad255a608c988d6263d8bf068e504fb\dokan.sys"65:T503,"msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\dokan.dll" "msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\e2fsck.exe" "msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\extmounter.exe" "msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\fsdump.exe" "msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\mke2fs.conf" "msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\mke2fs.exe" "msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\mke2fs-hurd.conf" "msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\mklost+found.exe" "msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\paragon_service.exe" "msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Qt5Core.dll" "msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\qtbase.qm" "msiexec.exe" touched file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\qwindows.dll"66:T67dc,"msiexec.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\782D7E2BFB036A849A99FFA65C652D39" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_2F4E03F10A4A01EDF8DD2FCAF5862404" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_1C72B0D0B477924E3F62D28A4D4FDF1F" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E506CEBBC8B162CFB2D72DB4891DCAE" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4EA555947766F67C3BB52DEDFD509C5" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_38924EDF39D8802D6946FB22E5DD0835" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_CAF45FDC3736D8D4B3A07D258CEC8D47" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FC68FB72D4FBC7E0F151BC2282D75E47_367FA2447481C3DB640CE44BE2E5A181" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FC68FB72D4FBC7E0F151BC2282D75E47_EB1C5E06BF3344F593EDE146B267D980" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4D8404427A196184A4B981C5CCDA3643" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\72EEF18E0160F79A0810E7AE28BBCBAC" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\af-ZA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\am-ET\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ar-SA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\as-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\az-Latn-AZ\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\be-BY\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\bg-BG\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\bn-BD\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\bn-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\bs-Latn-BA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ca-ES\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ca-ES-valencia\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\chr-CHER-US\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\cs-CZ\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\cy-GB\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\da-DK\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\de-DE\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\el-GR\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\en\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\en-GB\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\es-ES\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\es-MX\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\et-EE\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\eu-ES\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\fa-IR\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\fi-FI\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\fil-PH\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\fr-CA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\fr-FR\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ga-IE\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\gd-GB\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\gl-ES\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\gu-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ha-Latn-NG\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\he-IL\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\hi-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\hr-HR\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\hu-HU\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\hy-AM\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\id-ID\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ig-NG\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\is-IS\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\it-IT\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ja-jp\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ka-GE\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\kk-KZ\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\km-KH\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\kn-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ko-KR\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\kok-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ku-Arab-IQ\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ky-KG\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\lb-LU\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\lo-LA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\lt-LT\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\lv-LV\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\mi-NZ\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\mk-MK\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ml-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\mn-MN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\mr-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ms-MY\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\mt-MT\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\nb-NO\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ne-NP\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\nl-NL\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\nn-NO\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\nso-ZA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\or-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\pa-Arab-PK\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\pa-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\pl-PL\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\prs-AF\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\pt-BR\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\pt-PT\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\quc-Latn-GT\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\quz-PE\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ro-RO\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ru-RU\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\rw-RW\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\sd-Arab-PK\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\si-LK\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\sk-SK\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\sl-SI\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\sq-AL\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\sr-Cyrl-BA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\sr-Cyrl-RS\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\sr-Latn-CS\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\sr-Latn-RS\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\sv-SE\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\sw-KE\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ta-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\te-IN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\tg-Cyrl-TJ\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\th-TH\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ti-ET\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\tk-TM\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\tn-ZA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\tr-TR\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\tt-RU\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ug-CN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\uk-UA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\ur-PK\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\uz-Latn-UZ\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\vi-VN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\wo-SN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\xh-ZA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\yo-NG\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\zh-CN\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\zh-HK\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\zh-TW\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\zu-ZA\SXS.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\MSIEXEC.EXE.CONFIG" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\en\MSIMSG.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\Installer\INPROGRESSINSTALLINFO.IPI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\af-ZA\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\am-ET\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ar-SA\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\as-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\az-Latn-AZ\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\be-BY\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\bg-BG\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\bn-BD\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\bn-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\bs-Latn-BA\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ca-ES\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ca-ES-valencia\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\chr-CHER-US\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\cs-CZ\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\cy-GB\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\da-DK\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\de-DE\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\el-GR\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\en\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\en-GB\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\es-ES\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\es-MX\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\et-EE\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\eu-ES\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\fa-IR\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\fi-FI\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\fil-PH\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\fr-CA\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\fr-FR\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ga-IE\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\gd-GB\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\gl-ES\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\gu-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ha-Latn-NG\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\he-IL\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\hi-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\hr-HR\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\hu-HU\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\hy-AM\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\id-ID\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ig-NG\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\is-IS\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\it-IT\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ja-JP\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ka-GE\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\kk-KZ\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\km-KH\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\kn-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ko-KR\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\kok-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ku-Arab-IQ\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ky-KG\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\lb-LU\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\lo-LA\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\lt-LT\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\lv-LV\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\mi-NZ\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\mk-MK\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ml-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\mn-MN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\mr-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ms-MY\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\mt-MT\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\nb-NO\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ne-NP\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\nl-NL\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\nn-NO\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\nso-ZA\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\or-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\pa-Arab-PK\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\pa-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\pl-PL\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\prs-AF\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\pt-BR\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\pt-PT\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\quc-Latn-GT\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\quz-PE\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ro-RO\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ru-RU\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\rw-RW\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\sd-Arab-PK\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\si-LK\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\sk-SK\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\sl-SI\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\sq-AL\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\sr-Cyrl-BA\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\sr-Cyrl-RS\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\sr-Latn-CS\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\sr-Latn-RS\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\sv-SE\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\sw-KE\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ta-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\te-IN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\tg-Cyrl-TJ\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\th-TH\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ti-ET\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\tk-TM\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\tn-ZA\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\tr-TR\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\tt-RU\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ug-CN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\uk-UA\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\ur-PK\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\uz-Latn-UZ\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\vi-VN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\wo-SN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\xh-ZA\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\yo-NG\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\zh-CN\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\zh-HK\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\zh-TW\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\SysWOW64\zu-ZA\ADVAPI32.DLL.MUI" "msiexec.exe" trying to access non-existent file "C:\Windows\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5" "msiexec.exe" trying to access non-existent file "C:\MSI2D2C9.TMP" "msiexec.exe" trying to access non-existent file "C:\share\MSI2D2CA.TMP" "msiexec.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LINUX FILE SYSTEMS FOR WINDOWS BY PARAGON SOFTWARE" "msiexec.exe" trying to access non-existent file "C:\Users\Public\Desktop\LINUX FILE SYSTEMS FOR WINDOWS BY PARAGON SOFTWARE.LNK" "msiexec.exe" trying to access non-existent file "C:\Windows\System32\MSIEXEC.EXE.LOCAL" "msiexec.exe" trying to access non-existent file "C:\Windows\Installer\137032.MSI" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DOKANDRV8X64" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DOKANDRV8X86" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DOKANDRV10X64" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DOKANDRV7X64" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DOKANDRV10X86" "msiexec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\DOKANDRV7X86" "MsiExec.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSIEXEC.EXE.LOCAL" "MsiExec.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSIWERCRASHMETADATA-41" "MsiExec.exe" trying to access non-existent file "C:\WXSTD.MO" "MsiExec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\lang\en\WXSTD.MO" "MsiExec.exe" trying to access non-existent file "C:\Windows\SysWOW64\en\WXSTD.MO" "MsiExec.exe" trying to access non-existent file "C:\LANG.MO" "MsiExec.exe" trying to access non-existent file "C:\WXLANG.MO" "MsiExec.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\lang\en\WXLANG.MO" "MsiExec.exe" trying to access non-existent file "C:\Windows\SysWOW64\en\WXLANG.MO" "MsiExec.exe" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "MsiExec.exe" trying to access non-existent file "C:\Windows\System32\MSIEXEC.EXE.LOCAL" "MsiExec.exe" trying to access non-existent file "C:\MsiWerCrashmetadata-41" "MsiExec.exe" trying to access non-existent file "C:\Windows\System32\DRVSTORE\DOKAN_03786891CAD255A608C988D6263D8BF068E504FB" "MsiExec.exe" trying to access non-existent file "C:\Windows\System32\DRVSTORE\dokan_03786891CAD255A608C988D6263D8BF068E504FB\DOKAN.SYS" "MsiExec.exe" trying to access non-existent file "C:\Windows\System32\drivers\DOKAN.SYS" "MsiExec.exe" trying to access non-existent file "C:\Windows\System32\DOKAN.SYS"67:T4bf5,"msiexec.exe" writes file "\device\namedpipe\wkssvc" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\77ec63bda74bd0d0e0426dc8f8008506" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_178c086b699fd6c56b804af3ef759cb5" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_178c086b699fd6c56b804af3ef759cb5" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_ab5eaaa21df673505b87d680ac76b6e1" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_ab5eaaa21df673505b87d680ac76b6e1" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\782d7e2bfb036a849a99ffa65c652d39" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\782d7e2bfb036a849a99ffa65c652d39" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\616ad1ab067cfd351d6c0ef6f3e12f40" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\616ad1ab067cfd351d6c0ef6f3e12f40" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\66ae3bfdf94a732b262342ad2154b86e_2f4e03f10a4a01edf8dd2fcaf5862404" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\66ae3bfdf94a732b262342ad2154b86e_2f4e03f10a4a01edf8dd2fcaf5862404" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\66ae3bfdf94a732b262342ad2154b86e_1c72b0d0b477924e3f62d28a4d4fdf1f" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\66ae3bfdf94a732b262342ad2154b86e_1c72b0d0b477924e3f62d28a4d4fdf1f" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\0e506cebbc8b162cfb2d72db4891dcae" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\0e506cebbc8b162cfb2d72db4891dcae" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\f4ea555947766f67c3bb52dedfd509c5" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\f4ea555947766f67c3bb52dedfd509c5" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_38924edf39d8802d6946fb22e5dd0835" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_38924edf39d8802d6946fb22e5dd0835" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_caf45fdc3736d8d4b3a07d258cec8d47" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_caf45fdc3736d8d4b3a07d258cec8d47" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\fc68fb72d4fbc7e0f151bc2282d75e47_367fa2447481c3db640ce44be2e5a181" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\fc68fb72d4fbc7e0f151bc2282d75e47_367fa2447481c3db640ce44be2e5a181" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\fc68fb72d4fbc7e0f151bc2282d75e47_eb1c5e06bf3344f593ede146b267d980" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\fc68fb72d4fbc7e0f151bc2282d75e47_eb1c5e06bf3344f593ede146b267d980" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\4d8404427a196184a4b981c5ccda3643" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\4d8404427a196184a4b981c5ccda3643" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\72eef18e0160f79a0810e7ae28bbcbac" "msiexec.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\72eef18e0160f79a0810e7ae28bbcbac" "msiexec.exe" writes file "c:\users\%osuser%\appdata\local\temp\msi47e9.tmp" "msiexec.exe" writes file "c:\users\%osuser%\appdata\local\temp\msi1750.tmp" "msiexec.exe" writes file "c:\users\%osuser%\appdata\local\temp\msi1974.tmp" "msiexec.exe" writes file "c:\users\%osuser%\appdata\local\temp\msi2f7e.tmp" "msiexec.exe" writes file "c:\windows\installer\137032.msi" "msiexec.exe" writes file "c:\windows\installer\msiae47.tmp" "msiexec.exe" writes file "c:\users\%osuser%\appdata\local\temp\lang\en\lang.mo" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\utils\cygwin1.dll" "msiexec.exe" writes file "c:\users\%osuser%\appdata\local\temp\dokandrv10x64\dokan.cat" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\dokan.dll" "msiexec.exe" writes file "c:\users\%osuser%\appdata\local\temp\dokandrv10x64\dokan.inf" "msiexec.exe" writes file "c:\users\%osuser%\appdata\local\temp\dokandrv10x64\dokan.sys" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\utils\e2fsck.exe" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\extmounter.exe" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\utils\fsdump.exe" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\fs4winui_lang.qm" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\utils\mke2fs.conf" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\utils\mke2fs.exe" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\utils\mklost+found.exe" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\paragon_service.exe" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\linux file systems for windows by paragon software.exe" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\qt5core.dll" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\qt5gui.dll" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\qt5widgets.dll" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\qtbase.qm" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\platforms\qwindows.dll" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\updater_lang.qm" "msiexec.exe" writes file "c:\program files (x86)\paragon software\linuxfs for windows\updater.exe" "msiexec.exe" writes file "c:\windows\installer\msi986.tmp" "MsiExec.exe" writes file "c:\users\%osuser%\appdata\local\temp\msi47e9.tmp" "MsiExec.exe" writes file "c:\users\%osuser%\appdata\local\temp\msi1750.tmp" "MsiExec.exe" writes file "c:\users\%osuser%\appdata\local\temp\msi1974.tmp" "MsiExec.exe" writes file "c:\users\%osuser%\appdata\local\temp\msi2f7e.tmp" "MsiExec.exe" writes file "c:\windows\installer\msi8abf.tmp" "MsiExec.exe" writes file "c:\windows\installer\msiadba.tmp" "MsiExec.exe" writes file "c:\windows\installer\msib26f.tmp" "MsiExec.exe" writes file "c:\windows\installer\msib500.tmp" "MsiExec.exe" writes file "c:\windows\installer\msib84d.tmp" "MsiExec.exe" writes file "c:\windows\installer\msi85c.tmp" "MsiExec.exe" writes file "c:\windows\installer\msibc9.tmp" "MsiExec.exe" writes file "c:\windows\installer\msi15bd.tmp" "MsiExec.exe" writes file "c:\windows\installer\msiae47.tmp" "MsiExec.exe" writes file "c:\windows\installer\msi986.tmp" "MsiExec.exe" writes file "c:\windows\installer\msicbe7.tmp" "MsiExec.exe" writes file "c:\windows\installer\msid9b3.tmp" "MsiExec.exe" writes file "c:\windows\installer\msidf42.tmp" "MsiExec.exe" writes file "c:\windows\installer\msie118.tmp" "MsiExec.exe" writes file "c:\windows\installer\msie501.tmp" "MsiExec.exe" writes file "c:\windows\installer\msieb0d.tmp" "reg.exe" writes file "\device\namedpipe" "MsiExec.exe" writes file "c:\windows\installer\msifba8.tmp" "MsiExec.exe" writes file "c:\windows\system32\drvstore\dokan_03786891cad255a608c988d6263d8bf068e504fb\dokan.inf" "MsiExec.exe" writes file "c:\windows\system32\drvstore\dokan_03786891cad255a608c988d6263d8bf068e504fb\dokan.cat" "MsiExec.exe" writes file "c:\windows\system32\drvstore\dokan_03786891cad255a608c988d6263d8bf068e504fb\dokan.sys" "MsiExec.exe" writes file "c:\windows\system32\drivers\set3d7.tmp" "MsiExec.exe" writes file "c:\windows\system32\catroot2\dberr.txt" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140u.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%programfiles%\(x86)\paragon software\linuxfs for windows\qt5core.dll" "msiexec.exe" writes file "%programfiles%\(x86)\paragon software\linuxfs for windows\paragon_service.exe" "msiexec.exe" writes file "%programfiles%\(x86)\paragon software\linuxfs for windows\platforms\qwindows.dll" "msiexec.exe" writes file "%programfiles%\(x86)\paragon software\linuxfs for windows\utils\e2fsck.exe" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\msvcp140.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%programfiles%\(x86)\paragon software\linuxfs for windows\utils\mke2fs.exe" "msiexec.exe" writes file "%programfiles%\(x86)\paragon software\linuxfs for windows\dokan.dll" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\vcamp140.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%programfiles%\(x86)\paragon software\linuxfs for windows\extmounter.exe" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\vccorlib140.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\concrt140.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfcm140u.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfcm140.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\vcruntime140.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140fra.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140deu.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140esn.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140ita.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140rus.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140enu.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140jpn.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140kor.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140cht.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\installer\$patchcache$\managed\b520fc0f3f6dc7f439b93292f12578c5\5.2.1146\mfc140chs.dll.41084701_5f61_3497_ac5d_d0a6d4a85536" "msiexec.exe" writes file "%windir%\system32\drvstore\dokan_03786891cad255a608c988d6263d8bf068e504fb\dokan.cat" "msiexec.exe" writes file "%temp%\dokandrv10x64\dokan.inf" "msiexec.exe" writes file "%windir%\installer\msi9416.tmp" "msiexec.exe" writes file "c:\config.msi\137033.rbs" "msiexec.exe" writes file "%windir%\installer\msifba8.tmp" "msiexec.exe" writes file "%windir%\installer\msidf42.tmp" "msiexec.exe" writes file "%windir%\installer\msicbe7.tmp" "msiexec.exe" writes file "%windir%\installer\msi986.tmp" "msiexec.exe" writes file "%windir%\installer\{f0cf025b-d6f3-4f7c-939b-23291f52875c}\linuxfs4win.ico" "MsiExec.exe" writes file "%windir%\system32\catroot2\dberr.txt" "MsiExec.exe" writes file "%temp%\msi47e9.tmp" "MsiExec.exe" writes file "%windir%\system32\drivers\set3d7.tmp" "MsiExec.exe" writes file "%windir%\installer\msib26f.tmp" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\77ec63bda74bd0d0e0426dc8f8008506" "msiexec.exe" writes file "%windir%\microsoft.net\framework64\v4.0.30319\ngen.log" "msiexec.exe" writes file "%programfiles%\(x86)\paragon software\linuxfs for windows\utils\mke2fs.conf" "msiexec.exe" writes file "%temp%\lang\en\lang.mo" "msiexec.exe" writes file "%programfiles%\(x86)\paragon software\linuxfs for windows\utils\mke2fs-hurd.conf" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\fc68fb72d4fbc7e0f151bc2282d75e47_eb1c5e06bf3344f593ede146b267d980" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_caf45fdc3736d8d4b3a07d258cec8d47" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_ab5eaaa21df673505b87d680ac76b6e1" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\66ae3bfdf94a732b262342ad2154b86e_1c72b0d0b477924e3f62d28a4d4fdf1f" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\fc68fb72d4fbc7e0f151bc2282d75e47_367fa2447481c3db640ce44be2e5a181" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_178c086b699fd6c56b804af3ef759cb5" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\42b9a473b4daf01285a36b4d3c7b1662_38924edf39d8802d6946fb22e5dd0835" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\66ae3bfdf94a732b262342ad2154b86e_2f4e03f10a4a01edf8dd2fcaf5862404" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\616ad1ab067cfd351d6c0ef6f3e12f40" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\616ad1ab067cfd351d6c0ef6f3e12f40" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\782d7e2bfb036a849a99ffa65c652d39" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\0e506cebbc8b162cfb2d72db4891dcae" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\f4ea555947766f67c3bb52dedfd509c5" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\72eef18e0160f79a0810e7ae28bbcbac" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\4d8404427a196184a4b981c5ccda3643" "msiexec.exe" writes file "%programfiles%\(x86)\paragon software\linuxfs for windows\qtbase.qm" "msiexec.exe" writes file "%windir%\installer\{f0cf025b-d6f3-4f7c-939b-23291f52875c}\paragonlinuxfsforwindows.exe" "msiexec.exe" writes file "%temp%\dokandrv10x64\dokan.cat" "msiexec.exe" writes file "%windir%\system32\drvstore\dokan_03786891cad255a608c988d6263d8bf068e504fb\dokan.inf" "MsiExec.exe" writes file "%windir%\installer\msib84d.tmp" "MsiExec.exe" writes file "%windir%\installer\msi8abf.tmp" "msiexec.exe" writes file "%windir%\installer\msie02d.tmp" "msiexec.exe" writes file "%windir%\installer\msid9b3.tmp" "msiexec.exe" writes file "%windir%\installer\msie501.tmp" "msiexec.exe" writes file "%windir%\installer\msieb0d.tmp" "msiexec.exe" writes file "%windir%\installer\msie118.tmp" "msiexec.exe" writes file "%windir%\installer\msiae47.tmp" "MsiExec.exe" writes file "%windir%\system32\drvstore\dokan_03786891cad255a608c988d6263d8bf068e504fb\dokan.sys" "MsiExec.exe" writes file "%temp%\dokandrv10x64\dokan.sys" "MsiExec.exe" writes file "%windir%\installer\msib500.tmp" "MsiExec.exe" writes file "%windir%\installer\msiadba.tmp" "MsiExec.exe" writes file "%windir%\installer\msi85c.tmp" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\66ae3bfdf94a732b262342ad2154b86e_2f4e03f10a4a01edf8dd2fcaf5862404" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\72eef18e0160f79a0810e7ae28bbcbac" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_ab5eaaa21df673505b87d680ac76b6e1" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\0e506cebbc8b162cfb2d72db4891dcae" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_178c086b699fd6c56b804af3ef759cb5" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_caf45fdc3736d8d4b3a07d258cec8d47" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\782d7e2bfb036a849a99ffa65c652d39" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\fc68fb72d4fbc7e0f151bc2282d75e47_367fa2447481c3db640ce44be2e5a181" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\4d8404427a196184a4b981c5ccda3643" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\f4ea555947766f67c3bb52dedfd509c5" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\fc68fb72d4fbc7e0f151bc2282d75e47_eb1c5e06bf3344f593ede146b267d980" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\66ae3bfdf94a732b262342ad2154b86e_1c72b0d0b477924e3f62d28a4d4fdf1f" "msiexec.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\42b9a473b4daf01285a36b4d3c7b1662_38924edf39d8802d6946fb22e5dd0835"68:T403,"msiexec.exe" called "RpcServerUseProtseqEpW" with parameter protseq ncalrpc & endpoint: OLECB05F56A329B1C3D5CC3E829590E (UID: 00000000-00006356) "msiexec.exe" called "RpcServerUseProtseqEpW" with parameter protseq ncalrpc & endpoint: OLEDCF8A526C07B412AC584C72E99B6 (UID: 00000000-00000736) "MsiExec.exe" called "RpcServerUseProtseqEpW" with parameter protseq ncalrpc & endpoint: OLEC18AA8FF3297C48687C725BA210F (UID: 00000000-00006328) "MsiExec.exe" called "RpcServerUseProtseqEpW" with parameter protseq ncalrpc & endpoint: OLE3682B49FE6AD42B2F049AB88C834 (UID: 00000000-00003844) "MsiExec.exe" called "RpcServerUseProtseqEpW" with parameter protseq ncalrpc & endpoint: OLE22221BB5D82DF09B7BB7AB2F23ED (UID: 00000000-00003760) "MsiExec.exe" called "RpcServerUseProtseqEpW" with parameter protseq ncalrpc & endpoint: OLE0063D10E8EB62BCE300D03F24A85 (UID: 00000000-00002092) "MsiExec.exe" called "RpcServerUseProtseqEpW" with parameter protseq ncalrpc & endpoint: OLE3A2E1A91EE9E966FB5AAE74474DF (UID: 00000000-00003680)69:Tf59,Found IP URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e2.5.29.12.5.4.3globalsign" - Source: "00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found IP URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt02.16.840.1.113730.1.1wvtasn1spclinkdecode1.3.6.1.4.1.311.2.1.41.3.14.3.2.26ahsm1.3.6.1.4.1.311.2.4.3wvtasn1spclinkdecode1.3.6.1.4.1.311.2.4.21.3.6.1.4.1.311.2.1.30verifyindirectdata1.3.6.1.4.1.311.2.1.251.3.6.1.4.1.311.2.1.271.3.6.1.4.1.311.2.4.4ahsm" - Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp") Found IP URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp") Found IP URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00006356.00000000.78565.1E040000.00000004.mdmp") Found IP URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt02.23.140.1.4.12.16.840.1.113730.1.1wvtasn1spclinkdecode1.3.6.1.4.1.311.2.1.41.3.14.3.2.26ahsm1.3.6.1.4.1.311.2.4.3wvtasn1spclinkdecode1.3.6.1.4.1.311.2.4.21.3.6.1.4.1.311.2.1.30verifyindirectdata1.3.6.1.4.1.311.2.1.251.3.6.1.4.1.311.2.1.271.3.6.1.4.1.311.2.4.4ahsmesdsipverifyhash1.3.6.1.5.5.7.3.31.3.6.1.4.1.311.2.1.261.2.840.113549.1.1.41.3.6.1.4.1.311.21.11.3.6.1.4.1.311.20.2wvtasn1spclinkdecodeverifyindirectdata1.3.6.1.4.1.311.2.1.28verifyindirectdatapsverifyhashahsm1.3.6.1.5.5.7.3.82.16.840.1.114412.7.11.2.840.113549.1.1.121.2.840.113549.1.1.2wvtasn1spcsiginfodecode2.16.840.1.114412.3.1cryptsipverifyindirectdata1.3.6.1.4.1.311.10.3.301.3.6.1.4.1.311.10.11.15cryptsipverifyindirectdatacryptsipverifyindirectdata" - Source: "00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp") Found IP URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp") Found IP URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp") Found IP URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt02.23.140.1.4.12.16.840.1.113730.1.1wvtasn1spclinkdecode1.3.6.1.4.1.311.2.1.41.3.14.3.2.26ahsm1.3.6.1.4.1.311.2.4.3wvtasn1spclinkdecode1.3.6.1.4.1.311.2.4.21.3.6.1.4.1.311.2.1.30verifyindirectdata1.3.6.1.4.1.311.2.1.251.3.6.1.4.1.311.2.1.271.3.6.1.4.1.311.2.4.4ahsmesdsipverifyhash1.3.6.1.5.5.7.3.31.3.6.1.4.1.311.2.1.261.2.840.113549.1.1.41.3.6.1.4.1.311.21.11.3.6.1.4.1.311.20.2wvtasn1spclinkdecodeverifyindirectdata1.3.6.1.4.1.311.2.1.28verifyindirectdatapsverifyhashahsm1.3.6.1.5.5.7.3.82.16.840.1.114412.7.11.2.840.113549.1.1.121.2.840.113549.1.1.2wvtasn1spcsiginfodecode2.16.840.1.114412.3.1cryptsipverifyindirectdata1.3.6.1.4.1.311.10.3.301.3.6.1.4.1.311.10.11.15cryptsipverifyindirectdatacryptsipverifyindirectdata" - Source: "00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found IP URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found IP URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00006356.00000002.82407.1E040000.00000004.mdmp")6a:T47ef,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000736.00000001.80985.23110000.00000004.mdmp") Found URL "http://crl4.digicert.com/sha2-assured-ts.crlapi_ms_win_core_datetime_l1_1_0.dll.41084701_5f61_3497_ac5d_d0a6d4a85536api_ms_win_core_file_l2_1_0.dll.41084701_5f61_3497_ac5d_d0a6d4a85536xyxdaava.exe" - Source: "00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-ts.crlname" - Source: "00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found URL "https://www.paragon-software.com/privacy/" - Source: "00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found URL "https://www.paragon-software.com/terms/" - Source: "00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found URL "http://www.digicert.com/cps0j0h02,http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0brqtqjxy6z'dwc_" - Source: "00000000-00000736.00000002.82905.23380000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps08ambf$" - Source: "00000000-00000736.00000002.82905.23380000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c," - Source: "00000000-00000736.00000002.82905.263C0000.00000004.mdmp") Found URL "http://crl.mcrosoftcodeverifroot.crl0g" - Source: "00000000-00000736.00000002.82905.263C0000.00000004.mdmp") Found URL "http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0digicert" - Source: "00000000-00000736.00000002.82905.263C0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0j0h02,http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0brqtqjxy6z'dwc_" - Source: "00000000-00000736.00000002.82905.263C0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps08ambf$" - Source: "00000000-00000736.00000002.82905.263C0000.00000004.mdmp") Found URL "https://www.partware.com/terms/" - Source: "00000000-00000736.00000002.82905.268B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbt3xl4lqlxdrdm9p665tw442vrsuqqureuir%2fssy4ixlvglp6chnfntya8ceaqjgbtf1btmdvndtw%2bvuag%3d" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsnr4foxllki7vkvsuiflzt%2blgh3gquwss5eyoko6xqcqpaypkt9mv1dlgcealou8nnnskoqduubpziods%3dhyper-v" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbt5hgd4pkvs0jffleknq1cjbllipqqu9lbhib3%2bka7s5gglsqilssgxnw4cea1csuc%2booj%2fyeahzhqa8n0%3dclick" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://crl4.digicert.com/sha2-assured-cs-g1.crlthe" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl:\windows\microsoft.net\framework64\v4.0.30319\\ngen.logcrl4.digicert.comthe" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicertassuredidrootca.crlybinary" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertassuredidrootca.crlythe" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbt3xl4lqlxdrdm9p665tw442vrsuqqureuir%2fssy4ixlvglp6chnfntya8ceaqhjdbwmht%2bqeqf2jaxwhu%3dhighlighted" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0wvtasn1spcspopusinfodecodeeappxsipverifyindirectdatawvtasn1spcindirectdatacontentdecodecryptsipverifyindirectdatawvtasn1intenttosealattributedecodewvtasn1catnamevaluedecodewvtasn1spcpeimagedatadecode" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0>^" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=washington1redmond1microsoft" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=q*iq=!/nsbz69fw4=%ory08>=i@iqoz" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0gnuqr'q" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://www.microsoft.com05" - Source: "00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0oh0f080*0(https://www.digicert.com/cps0," - Source: "00000000-00006356.00000000.78565.1DF40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0g" - Source: "00000000-00006356.00000000.78565.1DF40000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crl05/http://crl4.digicert.com/sha2-assured-cs-g1.crl0le0c070*0(https://www.digicert.com/cps0x0v0$http://ocsp.digicert.com0nbhttp://cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0digicert" - Source: "00000000-00006356.00000000.78565.1DF40000.00000004.mdmp") Found URL "http://www.digicert.com/cps0j0h02,http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0brqtqjxy6z'dwc_" - Source: "00000000-00006356.00000000.78565.1DF40000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0z0x0:4http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps08ambf$" - Source: "00000000-00006356.00000000.78565.1DF40000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006356.00000000.78565.1E040000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,^" - Source: "00000000-00006356.00000000.78565.1E040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006356.00000000.78565.1E040000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00006356.00000000.78565.1E040000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbt3xl4lqlxdrdm9p665tw442vrsuqqureuir%2fssy4ixlvglp6chnfntya8ceaqjgbtf1btmdvndtw%2bvuag%3da" - Source: "00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=0e,xcommonprogramfiles=c:\program" - Source: "00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp") Found URL "https://www.digicedigicertw!" - Source: "00000000-00006356.00000001.80484.1DF40000.00000004.mdmp") Found URL "http://www.digicert.com/cps0j0h02,http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2asa.crbrqtdigicert" - Source: "00000000-00006356.00000001.80484.1DF40000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps0mhaas]*/ps" - Source: "00000000-00006356.00000001.80484.1DF40000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0brqtqjxy6z'dwc_" - Source: "00000000-00006356.00000001.80484.1DF40000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt:\users\hapubws\appdata\roaming\microsoft\systemcertificates\myoftware\policies\microsoft\systemcertificates\trustedpeoplelinux" - Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsnr4foxllki7vkvsuiflzt%2blgh3gquwss5eyoko6xqcqpaypkt9mv1dlgcealou8nnnskoqduubpziods%3dactivationerrordlgpermachinedescriptiontermsandconditioninformation" - Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp") Found URL "https://www.paragon-software.com/privacy/" - Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,^" - Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0gnuqr'q" - Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp") Found URL "http://www.microsoft.com05" - Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicertassuredidrootca.crlyoritnew" - Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp") Found URL "http://crl4.digicert.com/sha2-assured-cs-g1.crlproductlanguage" - Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertassuredidrootca.crlythe" - Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-cs-g1.crlsequence" - Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbt3xl4lqlxdrdm9p665tw442vrsuqqureuir%2fssy4ixlvglp6chnfntya8ceaqhjdbwmht%2bqeqf2jaxwhu%3drea" - Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp") Found URL "https://www.paragon-software.com/privacy/" - Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp") Found URL "http://crl4.digicert.com/sha2-assured-ts.crla" - Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp") Found URL "https://www.paragon-software.com/terms/" - Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-ts.crlthe" - Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbt5hgd4pkvs0jffleknq1cjbllipqqu9lbhib3%2bka7s5gglsqilssgxnw4cea1csuc%2booj%2fyeahzhqa8n0%3dif" - Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp") Found URL "http://www.paragon-software.com/eula.html.(status" - Source: "00000000-00006356.00000001.80484.1F557000.00000004.mdmp") Found URL "https://www.paragon@software.com/terms/" - Source: "00000000-00006356.00000001.80484.1F557000.00000004.mdmp") Found URL "https://www.paragon@software.com/terms/.5." - Source: "00000000-00006356.00000001.80484.1F557000.00000004.mdmp") Found URL "http://www.paragon@software.com/eula.html.(status" - Source: "00000000-00006356.00000001.80484.1F557000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbt3xl4lqlxdrdm9p665tw442vrsuqqureuir%2fssy4ixlvglp6chnfntya8ceaqjgbtf1btmdvndtw%2bvuag%3dwin10found=" - Source: "00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=0e,xcommonprogramfiles=c:\program" - Source: "00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found URL "http://www.digicert.com/cps0j0h02,http://rl3.dig0rtsha2asa.crbrqtdigicert" - Source: "00000000-00006356.00000002.82407.1DF40000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicertassuredidrootca.crl0:4http://crl3.digicert.com/digicertassuredidrootca.crl0pi0g080*0(https://www.digicert.com/cps0mhaas]*/ps" - Source: "00000000-00006356.00000002.82407.1DF40000.00000004.mdmp") Found URL "http://crl3.digicert.com/sha2-assured-ts.crl02,http://crl4.digicert.com/sha2-assured-ts.crl0y0w0$http://ocsp.digicert.com0ochttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt0brqtqjxy6z'dwc_" - Source: "00000000-00006356.00000002.82407.1DF40000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://cacerts.digicert.com/digicertsha2assuredidtimestampingca.crt:\users\hapubws\appdata\roaming\microsoft\systemcertificates\myoftware\policies\microsoft\systemcertificates\trustedpeoplelinux" - Source: "00000000-00006356.00000002.82407.1E040000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsnr4foxllki7vkvsuiflzt%2blgh3gquwss5eyoko6xqcqpaypkt9mv1dlgcealou8nnnskoqduubpziods%3dactivationerrordlgpermachinedescriptiontermsandconditioninformation" - Source: "00000000-00006356.00000002.82407.1E040000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00006356.00000002.82407.1E040000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,^" - Source: "00000000-00006356.00000002.82407.1E040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006356.00000002.82407.1E040000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=1.3.6.1.4.1.311.10.1210316072924z0/^g(o-cejy" - Source: "00000000-00006356.00000002.82407.1E040000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0gnuqr'q" - Source: "00000000-00006356.00000002.82407.1E040000.00000004.mdmp") Found URL "http://www.microsoft.com05" - Source: "00000000-00006356.00000002.82407.1E040000.00000004.mdmp")6b:T6e8,YARA signature for RC4 encryption matched on file "dokan.dll" YARA signature for RC4 encryption matched on file "cygwin1.dll" YARA signature for RC4 encryption matched on file "qwindows.dll" YARA signature for RC4 encryption matched on file "MSIB84D.tmp" YARA signature for RC4 encryption matched on file "MSI8ABF.tmp" YARA signature for RC4 encryption matched on file "MSIDF42.tmp" YARA signature for RC4 encryption matched on file "MSIE02D.tmp" YARA signature for RC4 encryption matched on file "Updater.exe" YARA signature for RC4 encryption matched on file "Qt5Gui.dll" YARA signature for RC4 encryption matched on file "Linux File Systems for Windows by Paragon Software.exe" YARA signature for RC4 encryption matched on file "ParagonLinuxFSforWindows.exe" YARA signature for RC4 encryption matched on file "MSI9416.tmp" YARA signature for RC4 encryption matched on file "mfc140u.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" YARA signature for RC4 encryption matched on file "Qt5Widgets.dll" YARA signature for RC4 encryption matched on file "MSI85C.tmp" YARA signature for RC4 encryption matched on file "MSIADBA.tmp" YARA signature for RC4 encryption matched on file "MSIB500.tmp" YARA signature for RC4 encryption matched on file "MSIB26F.tmp" YARA signature for RC4 encryption matched on process "00000000-00006356" YARA signature for RC4 encryption matched on file "mfc140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" YARA signature for RC4 encryption matched on file "extmounter.exe" YARA signature for RC4 encryption matched on file "MSIE118.tmp" YARA signature for RC4 encryption matched on file "MSIE501.tmp" YARA signature for RC4 encryption matched on file "MSID9B3.tmp" YARA signature for RC4 encryption matched on file "MSICBE7.tmp"6c:Ta20,Found string "+ncalrpc:[OLEDCF8A526C07B412AC584C72E99B6]" (Indicator: "ncalrpc"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found string "F+ncalrpc:[OLEC18AA8FF3297C48687C725BA210F]" (Indicator: "ncalrpc"; Source: "00000000-00000736.00000001.80985.23110000.00000004.mdmp") Found string "+ncalrpc:[OLECB05F56A329B1C3D5CC3E829590E]" (Indicator: "ncalrpc"; Source: "00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found string "+ncalrpc:[OLEC18AA8FF3297C48687C725BA210F]" (Indicator: "ncalrpc"; Source: "00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found string "+ncalrpc:[OLE22221BB5D82DF09B7BB7AB2F23ED]" (Indicator: "ncalrpc"; Source: "00000000-00000736.00000002.82905.264C0000.00000004.mdmp") Found string "+ncalrpc:[OLE3682B49FE6AD42B2F049AB88C834]" (Indicator: "ncalrpc"; Source: "00000000-00000736.00000002.82905.264C0000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found string "+ncalrpc:[OLECB05F56A329B1C3D5CC3E829590E]" (Indicator: "ncalrpc"; Source: "00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp") Found string "+ncalrpc:[OLEDCF8A526C07B412AC584C72E99B6]" (Indicator: "ncalrpc"; Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp") Found string "B+ncalrpc:[OLEDCF8A526C07B412AC584C72E99B6]" (Indicator: "ncalrpc"; Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp") Found string "+ncalrpc:[OLEC18AA8FF3297C48687C725BA210F]" (Indicator: "ncalrpc"; Source: "00000000-00006356.00000002.82407.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp") Found string "B+ncalrpc:[OLEDCF8A526C07B412A" (Indicator: "ncalrpc"; Source: "00000000-00006356.00000002.82407.1F470000.00000004.mdmp")6d:T5c0,"msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845294" "cx": "32" "cy": "32"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845294" "cx": "16" "cy": "16"} "msiexec.exe" called "CreateCompatibleBitmap" (UID: 00000000-00006356) "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845298" "cx": "32" "cy": "32"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845298" "cx": "16" "cy": "16"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "33622016" "cx": "74" "cy": "22"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "100729044" "cx": "74" "cy": "22"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845294" "cx": "17" "cy": "182"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1325468087" "cx": "17" "cy": "182"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845294" "cx": "17" "cy": "148"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16845294" "cx": "74" "cy": "22"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "234947876" "cx": "17" "cy": "182"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "33622016" "cx": "17" "cy": "182"} "msiexec.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "234947876" "cx": "17" "cy": "148"}6e:T415,"reg.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "284" "$name": "C:\\Windows\\SysWOW64\\reg.exe"} "reg.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "10" "TokenHandle": "344" "$name": "C:\\Windows\\SysWOW64\\reg.exe"} "reg.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "288" "$name": "C:\\Windows\\SysWOW64\\reg.exe"} "reg.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "10" "TokenHandle": "348" "$name": "C:\\Windows\\SysWOW64\\reg.exe"} "reg.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "8" "TokenHandle": "292" "$name": "C:\\Windows\\SysWOW64\\reg.exe"} "reg.exe" called "NtOpenProcessToken" with parameters {"ProcessHandle": "4294967295" "DesiredAccess": "10" "TokenHandle": "352" "$name": "C:\\Windows\\SysWOW64\\reg.exe"}6f:T99c,"msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006356) "msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00006356) "msiexec.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006356) "msiexec.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006356) "msiexec.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006356) "msiexec.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006356) "msiexec.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006356) "msiexec.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006356) "msiexec.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00006356) "msiexec.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00006356) "msiexec.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006356) "msiexec.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\ParagonMounter.log (UID: 00000000-00006356) "msiexec.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\FS4WinUI.log (UID: 00000000-00006356) "msiexec.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\Paragon Software\LinuxFS for Windows\*.dmp (UID: 00000000-00006356) "msiexec.exe" called "FindFirstFileW" with parameter %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Linux File Systems for Windows by Paragon Software\ (UID: 00000000-00006356) "msiexec.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00000736) "msiexec.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000736) "msiexec.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00000736) "msiexec.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00000736) "msiexec.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00000736) "msiexec.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00000736) "msiexec.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00000736) "msiexec.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00000736)70:T67f,Found reference to API "wxBitmap::CopyFromIconOrCursor - BitBlt" (Indicator: "BitBlt"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API ""CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin"), Found reference to API "GetDIBits()" (Indicator: "GetDIBits"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin"), Found reference to API "CreateCompatibleDC(NULL)" (Indicator: "CreateCompatibleDC"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin"), Found reference to API "GdipGetDC" (Indicator: "GetDC"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin"), Found reference to API "CreateDC(printer)" (Indicator: "CreateDC"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin"), Found reference to API "153697822376 6268 3146 CreateCompatibleBitmap Gdi32.dll "00:21:27.546" RX=0 PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp"), Found reference to API "148352030136 6268 3146 CreateCompatibleBitmap Gdi32.dll "00:21:25.312" RX=0 PX=0" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp")71:T80a,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")72:Ta50,Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegOpenKey"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "RegEnumKeyW" (Indicator: "RegEnumKey"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")73:T96c,Found reference to API "GetTempPath" (Indicator: "GetTempPath"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")74:T4b2,Found reference to API "" (Indicator: "RtlGetVersion"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "PRINT,NS_VistaRTMVersionLie::APIHook_RtlGetVersion,174,[ApiName] Hook Entered" (Indicator: "RtlGetVersion"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RtlGetVersion"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "PRINT,NS_VistaRTMVersionLie::APIHook_RtlGetVersion,174,[ApiName] Hook Entered" (Indicator: "RtlGetVersion"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp")75:T628,Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcessToken"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "OpenProcessToken failed with %d" (Indicator: "OpenProcessToken"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")76:T59d,Found string "\Device\HarddiskVolume2\Windows\System32\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000736.00000002.82905.264C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\msiexec.exe" (Indicator: "\Device\"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp")77:T476,Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp")78:Tdbb,Found reference to API "RegDeleteKeyEx" (Indicator: "RegDeleteKey"; File: "9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin") Found reference to API "RPRegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "RPRegDeleteKey" (Indicator: "RegDeleteKey"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteKey"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "RegDeleteValue"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp")79:T4f9,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "155251015813,584,3150,,AdjustTokenPrivileges,advapi32.dll,"00:21:35.203",RX=0,PX=0" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00000736.00000002.82905.268B0000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")7a:T4ae,Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp")7b:T1aeb,Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00000736.00000000.79067.23110000.00000004.mdmp, 00000000-00000736.00000001.80985.23110000.00000004.mdmp, 00000000-00000736.00000002.82905.23110000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetSecurityDescriptorLength" (Indicator: "GetSecurityDescriptorLength"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "SetSecurityDescriptorOwner" (Indicator: "SetSecurityDescriptorOwner"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "" (Indicator: "AccessCheck"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileSecurityW"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "SetSecurityDescriptorGroup" (Indicator: "SetSecurityDescriptorGroup"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "MakeAbsoluteSD" (Indicator: "MakeAbsoluteSD"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "MakeSelfRelativeSD" (Indicator: "MakeSelfRelativeSD"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp")7c:T48d,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp") Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "00000000-00000736.00000002.82905.268B0000.00000004.mdmp, 00000000-00000736.00000002.82905.288B0000.00000004.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp") Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; Source: "00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp") Found reference to API "SeCreateGlobalPrivilege" (Indicator: "SeCreateGlobalPrivilege"; Source: "00000000-00006356.00000001.80484.1E040000.00000004.mdmp")7d:T88f,"msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "ENABLEDHCP"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPV6DOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "msiexec.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")7e:T1ad1,"reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "224" "processHandle": "4294967295" "baseAddress": "4f0e70" "zeroBits": "0" "commitSize": "0" "viewSize": "299008" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "228" "processHandle": "4294967295" "baseAddress": "4f0840" "zeroBits": "0" "commitSize": "0" "viewSize": "1527808" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "232" "processHandle": "4294967295" "baseAddress": "4f0c60" "zeroBits": "0" "commitSize": "0" "viewSize": "90112" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "232" "processHandle": "4294967295" "baseAddress": "4f0a50" "zeroBits": "0" "commitSize": "0" "viewSize": "139264" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "236" "processHandle": "4294967295" "baseAddress": "4f0bb0" "zeroBits": "0" "commitSize": "0" "viewSize": "1433600" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "240" "processHandle": "4294967295" "baseAddress": "4f0000" "zeroBits": "0" "commitSize": "0" "viewSize": "507904" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "228" "processHandle": "4294967295" "baseAddress": "4f0b00" "zeroBits": "0" "commitSize": "0" "viewSize": "1011712" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "232" "processHandle": "4294967295" "baseAddress": "4f0f20" "zeroBits": "0" "commitSize": "0" "viewSize": "2383872" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "228" "processHandle": "4294967295" "baseAddress": "4f0210" "zeroBits": "0" "commitSize": "0" "viewSize": "602112" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "220" "processHandle": "4294967295" "baseAddress": "4f0d10" "zeroBits": "0" "commitSize": "0" "viewSize": "151552" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\Windows\\SysWOW64\\imm32.dll"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "356" "processHandle": "4294967295" "baseAddress": "1ff128" "zeroBits": "0" "commitSize": "0" "viewSize": "36864" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "228" "processHandle": "4294967295" "baseAddress": "31dff28" "zeroBits": "0" "commitSize": "0" "viewSize": "299008" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "232" "processHandle": "4294967295" "baseAddress": "31dffd8" "zeroBits": "0" "commitSize": "0" "viewSize": "1527808" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "236" "processHandle": "4294967295" "baseAddress": "31e08c8" "zeroBits": "0" "commitSize": "0" "viewSize": "90112" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "236" "processHandle": "4294967295" "baseAddress": "31e01e8" "zeroBits": "0" "commitSize": "0" "viewSize": "139264" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "240" "processHandle": "4294967295" "baseAddress": "31e0088" "zeroBits": "0" "commitSize": "0" "viewSize": "1433600" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "244" "processHandle": "4294967295" "baseAddress": "31e0138" "zeroBits": "0" "commitSize": "0" "viewSize": "507904" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "232" "processHandle": "4294967295" "baseAddress": "31dfdc8" "zeroBits": "0" "commitSize": "0" "viewSize": "1011712" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "236" "processHandle": "4294967295" "baseAddress": "31e0a28" "zeroBits": "0" "commitSize": "0" "viewSize": "2383872" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "232" "processHandle": "4294967295" "baseAddress": "31e0298" "zeroBits": "0" "commitSize": "0" "viewSize": "602112" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "224" "processHandle": "4294967295" "baseAddress": "31e0c38" "zeroBits": "0" "commitSize": "0" "viewSize": "151552" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4" "$name": "C:\\Windows\\SysWOW64\\imm32.dll"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "360" "processHandle": "4294967295" "baseAddress": "b7ecc8" "zeroBits": "0" "commitSize": "0" "viewSize": "36864" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "232" "processHandle": "4294967295" "baseAddress": "810008" "zeroBits": "0" "commitSize": "0" "viewSize": "299008" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "236" "processHandle": "4294967295" "baseAddress": "8109a8" "zeroBits": "0" "commitSize": "0" "viewSize": "1527808" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "reg.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "240" "processHandle": "4294967295" "baseAddress": "810218" "zeroBits": "0" "commitSize": "0" "viewSize": "90112" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"}7f:T1546,Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00000736] Dropped file: "FC68FB72D4FBC7E0F151BC2282D75E47_EB1C5E06BF3344F593EDE146B267D980" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\FC68FB72D4FBC7E0F151BC2282D75E47_EB1C5E06BF3344F593EDE146B267D980]- [targetUID: 00000000-00000736] Dropped file: "42B9A473B4DAF01285A36B4D3C7B1662_CAF45FDC3736D8D4B3A07D258CEC8D47" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_CAF45FDC3736D8D4B3A07D258CEC8D47]- [targetUID: 00000000-00000736] Dropped file: "42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1]- [targetUID: 00000000-00000736] Dropped file: "66AE3BFDF94A732B262342AD2154B86E_1C72B0D0B477924E3F62D28A4D4FDF1F" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_1C72B0D0B477924E3F62D28A4D4FDF1F]- [targetUID: 00000000-00000736] Dropped file: "FC68FB72D4FBC7E0F151BC2282D75E47_367FA2447481C3DB640CE44BE2E5A181" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\FC68FB72D4FBC7E0F151BC2282D75E47_367FA2447481C3DB640CE44BE2E5A181]- [targetUID: 00000000-00000736] Dropped file: "42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5]- [targetUID: 00000000-00000736] Dropped file: "42B9A473B4DAF01285A36B4D3C7B1662_38924EDF39D8802D6946FB22E5DD0835" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_38924EDF39D8802D6946FB22E5DD0835]- [targetUID: 00000000-00000736] Dropped file: "66AE3BFDF94A732B262342AD2154B86E_2F4E03F10A4A01EDF8DD2FCAF5862404" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_2F4E03F10A4A01EDF8DD2FCAF5862404]- [targetUID: 00000000-00000736] Dropped file: "77EC63BDA74BD0D0E0426DC8F8008506" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00000736] Dropped file: "616AD1AB067CFD351D6C0EF6F3E12F40" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40]- [targetUID: 00000000-00000736] Dropped file: "616AD1AB067CFD351D6C0EF6F3E12F40" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40]- [targetUID: 00000000-00000736] Dropped file: "782D7E2BFB036A849A99FFA65C652D39" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\782D7E2BFB036A849A99FFA65C652D39]- [targetUID: 00000000-00000736] Dropped file: "0E506CEBBC8B162CFB2D72DB4891DCAE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\0E506CEBBC8B162CFB2D72DB4891DCAE]- [targetUID: 00000000-00000736] Dropped file: "F4EA555947766F67C3BB52DEDFD509C5" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\F4EA555947766F67C3BB52DEDFD509C5]- [targetUID: 00000000-00000736] Dropped file: "72EEF18E0160F79A0810E7AE28BBCBAC" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\72EEF18E0160F79A0810E7AE28BBCBAC]- [targetUID: 00000000-00000736] Dropped file: "4D8404427A196184A4B981C5CCDA3643" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\4D8404427A196184A4B981C5CCDA3643]- [targetUID: 00000000-00000736] Dropped file: "66AE3BFDF94A732B262342AD2154B86E_2F4E03F10A4A01EDF8DD2FCAF5862404" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_2F4E03F10A4A01EDF8DD2FCAF5862404]- [targetUID: 00000000-00000736] Dropped file: "72EEF18E0160F79A0810E7AE28BBCBAC" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\72EEF18E0160F79A0810E7AE28BBCBAC]- [targetUID: 00000000-00000736] Dropped file: "42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1]- [targetUID: 00000000-00000736] Dropped file: "0E506CEBBC8B162CFB2D72DB4891DCAE" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\0E506CEBBC8B162CFB2D72DB4891DCAE]- [targetUID: 00000000-00000736] Dropped file: "42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5]- [targetUID: 00000000-00000736] Dropped file: "42B9A473B4DAF01285A36B4D3C7B1662_CAF45FDC3736D8D4B3A07D258CEC8D47" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_CAF45FDC3736D8D4B3A07D258CEC8D47]- [targetUID: 00000000-00000736] Dropped file: "782D7E2BFB036A849A99FFA65C652D39" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\782D7E2BFB036A849A99FFA65C652D39]- [targetUID: 00000000-00000736] Dropped file: "FC68FB72D4FBC7E0F151BC2282D75E47_367FA2447481C3DB640CE44BE2E5A181" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\FC68FB72D4FBC7E0F151BC2282D75E47_367FA2447481C3DB640CE44BE2E5A181]- [targetUID: 00000000-00000736]80:T405,File "dokan.cat" is a certificate (Owner: CN=Microsoft Windows Hardware Compatibility Publisher, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Windows Third Party Component CA 2014, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 33000000253a2738690a3451c1000000000025; Valid From: 09/06/2018 21:30:32; Until: 09/06/2019 21:30:32; Fingerprints: MD5=04:20:5D:A7:57:27:F9:48:E8:C6:62:80:DB:E2:FD:B0; SHA1=26:29:E8:6A:AE:6E:B9:C9:AD:CC:1C:54:8D:60:1A:50:FD:96:92:7A) File "dokan.cat" is a certificate (Owner: CN=Microsoft Windows Third Party Component CA 2014, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Root Certificate Authority 2010, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; SerialNumber: 330000000d690d5d7893d076df00000000000d; Valid From: 10/15/2014 20:31:27; Until: 10/15/2029 20:41:27; Fingerprints: MD5=DC:FA:56:50:8D:FF:12:0D:93:6D:D6:27:F3:8C:A2:F9; SHA1=19:06:DC:F6:26:29:B5:63:25:2C:82:6F:DD:87:4E:FC:EB:68:56:C6)81:T184b,"msiexec.exe" wrote 23622 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\cygwin1.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 17222 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\dokan.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 28249 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\dokandrv10x64\dokan.sys": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 22937 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\e2fsck.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 21401 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\extmounter.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 4562 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\mke2fs.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 9728 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\utils\mklost+found.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 21479 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\paragon_service.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000380100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 32663 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000400100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 4071 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Qt5Core.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000280100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 30695 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Qt5Gui.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 12820 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\platforms\qwindows.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000100100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "msiexec.exe" wrote 25367 bytes starting with PE header signature to file "C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Updater.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000380100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MsiExec.exe" wrote 11680 bytes starting with PE header signature to file "C:\Windows\System32\DRVSTORE\dokan_03786891CAD255A608C988D6263D8BF068E504FB\dokan.sys": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MsiExec.exe" wrote 11680 bytes starting with PE header signature to file "C:\Windows\System32\drivers\SET3D7.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...82:T197a,File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140u.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\msvcp140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\vcamp140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\vccorlib140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\concrt140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfcm140u.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfcm140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\vcruntime140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140fra.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140deu.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140esn.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140ita.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140rus.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140enu.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140jpn.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140kor.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140cht.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\B520FC0F3F6DC7F439B93292F12578C5\5.2.1146\mfc140chs.dll.41084701_5F61_3497_AC5D_D0A6D4A85536" File type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" was dropped at "%WINDIR%\Installer\MSIFBA8.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSIDF42.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSICBE7.tmp" File type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" was dropped at "%WINDIR%\Installer\MSI986.tmp" File type "PE32+ executable (native) x86-64 for MS Windows" was dropped at "%WINDIR%\System32\drivers\SET3D7.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSIB26F.tmp" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{F0CF025B-D6F3-4F7C-939B-23291F52875C}\ParagonLinuxFSforWindows.exe" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSIB84D.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSI8ABF.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSIE02D.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSID9B3.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSIE501.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSIEB0D.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSIE118.tmp" File type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" was dropped at "%WINDIR%\Installer\MSIAE47.tmp" File type "PE32+ executable (native) x86-64 for MS Windows" was dropped at "%WINDIR%\System32\DRVSTORE\dokan_03786891CAD255A608C988D6263D8BF068E504FB\dokan.sys" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSIB500.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSIADBA.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSI85C.tmp"83:T54c,Spawned process "reg.exe" with commandline "COPY "HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\ExtFS for Windows" "HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\Linux File Systems for Windows by Paragon Software" /reg:32 /s /f" (UID: 00000000-00003648) Spawned process "reg.exe" with commandline "DELETE "HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\ExtFS for Windows" /reg:32 /f" (UID: 00000000-00001536) Spawned process "reg.exe" with commandline "ADD "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\paragon_service.exe" /f /reg:64 /v DumpFolder /t REG_EXPAND_SZ /d "%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\crashdumps"" (UID: 00000000-00000880) Spawned process "WerFault.exe" with commandline "-u -p 880 -s 228" (UID: 00000000-00006108) Spawned process "WerFault.exe" with commandline "-u -p 880 -s 224" (UID: 00000000-00003424) Spawned process "reg.exe" with commandline "ADD "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\paragon_service.exe" /f /reg:64 /v DumpType /t REG_DWORD /d 1" (UID: 00000000-00004800) Spawned process "reg.exe" with commandline "ADD "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\paragon_service.exe" /f /reg:64 /v DumpCount /t REG_DWORD /d 16" (UID: 00000000-00003068)30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794430348279,"unified_at":"2026-11-11T20:52:28.279Z","metadata":{"hashes":{"sha256":"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79","sha1":"51a7bdc35e9fe8329fe846bc1dae6e5a370aab9e","md5":"95482920cad49acf6ec6e7830101b97c","sha512":"2d96f4dcc3b48ba33c8ba076dd91cbd4f95b28ded94f4f5147671592e2de0fe9d422a75227d471266c189f3da904f18fdc7c0e07e8a63e4ac0c161f0968d354a","ssdeep":"786432:/wJ8uELh7AFvStoCpKeyHtHiCar0oDm8FNs37VdX:IJ8BaaSNHXa4Uc7","ssdeep_chunks":["786432:/wJ8uEL","786432:wJ8uELh","786432:J8uELh7","786432:8uELh7A","786432:uELh7AF","786432:ELh7AFv","786432:Lh7AFvS","786432:h7AFvSt","786432:7AFvSto","786432:AFvStoC","786432:FvStoCp","786432:vStoCpK","786432:StoCpKe","786432:toCpKey","786432:oCpKeyH","786432:CpKeyHt","786432:pKeyHtH","786432:KeyHtHi","786432:eyHtHiC","786432:yHtHiCa","786432:HtHiCar","786432:tHiCar0","786432:HiCar0o","786432:iCar0oD","786432:Car0oDm","786432:ar0oDm8","786432:r0oDm8F","786432:0oDm8FN","786432:oDm8FNs","786432:Dm8FNs3","786432:m8FNs37","786432:8FNs37V","786432:FNs37Vd","786432:Ns37VdX","1572864:/wJ8uEL","1572864:wJ8uELh","1572864:J8uELh7","1572864:8uELh7A","1572864:uELh7AF","1572864:ELh7AFv","1572864:Lh7AFvS","1572864:h7AFvSt","1572864:7AFvSto","1572864:AFvStoC","1572864:FvStoCp","1572864:vStoCpK","1572864:StoCpKe","1572864:toCpKey","1572864:oCpKeyH","1572864:CpKeyHt","1572864:pKeyHtH","1572864:KeyHtHi","1572864:eyHtHiC","1572864:yHtHiCa","1572864:HtHiCar","1572864:tHiCar0","1572864:HiCar0o","1572864:iCar0oD","1572864:Car0oDm","1572864:ar0oDm8","1572864:r0oDm8F","1572864:0oDm8FN","1572864:oDm8FNs","1572864:Dm8FNs3","1572864:m8FNs37","1572864:8FNs37V","1572864:FNs37Vd","1572864:Ns37VdX","786432:IJ8BaaS","786432:J8BaaSN","786432:8BaaSNH","786432:BaaSNHX","786432:aaSNHXa","786432:aSNHXa4","786432:SNHXa4U","786432:NHXa4Uc","786432:HXa4Uc7"],"imphash":"Unknown"},"file_info":{"file_name":"linuxwin_trial.msi","file_type":["msi","data"],"file_type_id":"msi","file_size":38719488,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1612028637000,"last_seen":1702275465000,"last_multi_scan":1702275465000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":81},"sandbox_signatures":{"informative_count":188,"suspicious_count":23,"malicious_count":9,"total":220},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Persistence","technique":"New Service","attack_id":"T1050","attack_id_wiki":"https://attack.mitre.org/techniques/T1050","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Calls an API typically used to map section into the virtual address space of a process"},{"type":"informative","value":"Allocates virtual memory in a self process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Scans for the windows taskbar (may be used for explorer injection)"},{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"malicious","value":"Tries to delete registry keys using reg.exe"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"suspicious","value":"Modifies System Certificates Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"},{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/techniques/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Calls an API typically to used to retrieve file or directory information"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"suspicious","value":"The input sample dropped/contains a certificate file"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Calls an API during runtime"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loaded modules"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Persistence","technique":"DLL Search Order Hijacking","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a thread"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a process"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"Calls an API typically used to create hash value of data"},{"type":"informative","value":"Calls an API typically used to convert data from binary to string"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Hidden File System","attack_id":"T1564.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/005","identifiers":[{"type":"informative","value":"Creates inf file in Windows folder"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - Embedded Pdf document"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Queries volatile registry keys"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to create string binding handle (RPC)"},{"type":"informative","value":"Calls an API typically used to register protocol sequence (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Tries to copy files"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"malicious","value":"Drops system driver"},{"type":"informative","value":"Drops a Windows setup information (INF) file"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"malicious","value":"Making HTTPS connections using insecure TLS/SSL version"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP urls in memory dumps"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"suspicious","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains long base64 encoded strings"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API typically used to terminate process and its threads"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic DLLs"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00065733-00001088-00000046-3741801\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00066446-00001672-00000046-180057461\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00066446-00001672-00000046-218242020\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00066446-00001672-00000046-218260647","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"msiexec.exe\" queries volume information of \"C:\\\" at 00065733-00001088-00000046-3741801\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00066446-00001672-00000046-180057461\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00066446-00001672-00000046-218242020\n \"msiexec.exe\" queries volume information of \"C:\\\" at 00066446-00001672-00000046-218260647","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/60 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$37","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\build\\work\\eca3d12b\\wix3\\build\\ship\\x86\\uica.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"msiexec.exe\" created file \"%TEMP%\\TarD1AF.tmp\"\n \"msiexec.exe\" created file \"%TEMP%\\CabD1AE.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"MSI8D89.tmp\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"TarD1AF.tmp\" as clean (type is \"data\"), Antivirus vendors marked dropped file \"MSIFB35.tmp\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at F59E0000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"msiexec.exe\" touched \"Msi install server\" (Path: \"HKCU\\CLSID\\{000C101C-0000-0000-C000-000000000046}\")\n \"msiexec.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{000C103E-0000-0000-C000-000000000046}\")\n \"msiexec.exe\" touched \"Microsoft Windows Installer Message RPC\" (Path: \"HKCU\\CLSID\\{000C101D-0000-0000-C000-000000000046}\\DLLVERSION\")\n \"msiexec.exe\" touched \"SPP Class\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{4B966436-6781-4906-8035-9AF94B32C3F7}\")\n \"msiexec.exe\" touched \"VssSnapshotMgmt Class\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{0B5A2C52-3EB9-470A-96E2-6C6D4570E40F}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"msiexec.exe\" (UID: 00066446-00001672) was launched with modified environment variables: \"CommonProgramFiles, Path, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles\"\n Process \"msiexec.exe\" (UID: 00066446-00001672) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432, LOGONSERVER, PROMPT, HOMEPATH, HOMEDRIVE\"\n Process \"msiexec.exe\" (UID: 00073628-00002520) was launched with new environment variables: \"LOGONSERVER=\"\\\\HAPUBWS-PC\", PROMPT=\"$P$G\", HOMEPATH=\"\\Users\\FiyJpTQ\", HOMEDRIVE=\"C:\"\"\n Process \"msiexec.exe\" (UID: 00073628-00002520) was launched with modified environment variables: \"Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"msiexec.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"msiexec.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00066446-00001672)\n Spawned process \"msiexec.exe\" with commandline \"-Embedding 5E52A7C05427C0A48C49B685B6433227 C\" (UID: 00073628-00002520)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00066446-00001672)\n Spawned process \"msiexec.exe\" with commandline \"-Embedding 5E52A7C05427C0A48C49B685B6433227 C\" (UID: 00073628-00002520)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"C=DE, S=Baden-Wrttemberg, L=Freiburg im Breisgau, O=Paragon Software GmbH, CN=Paragon Software GmbH\" (SHA1: 04:15:60:59:D2:14:B6:6D:66:5C:AB:75:31:A7:27:F1:4D:0A:E0:00: (1.2.840.113549.1.1.11); see report for more information)\n The input sample is signed with a certificate issued by \"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Assured ID Code Signing CA\" (SHA1: 92:C1:58:8E:85:AF:22:01:CE:79:15:E8:53:8B:49:2F:60:5B:80:C6: (1.2.840.113549.1.1.11); see report for more information)\n The input sample is signed with a certificate issued by \"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA\" (SHA1: 05:63:B8:63:0D:62:D7:5A:BB:C8:AB:1E:4B:DF:B5:A8:99:B2:4D:43: (sha1RSA(RSA)); see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"msiexec.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"data\"\n \"42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5\" has type \"data\"\n \"CabD1AE.tmp\" has type \"Microsoft Cabinet archive data 59134 bytes 1 file\"\n \"MSI8D89.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4795 bytes 1 file\"\n \"TarD1AF.tmp\" has type \"data\"\n \"66AE3BFDF94A732B262342AD2154B86E_2F4E03F10A4A01EDF8DD2FCAF5862404\" has type \"data\"\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data 59134 bytes 1 file\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"data\"\n \"MSIFB35.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$38","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"Installation/Persistence","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\"msiexec.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$39","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"ch\\f43 (https://about.twitter.com/resources/buttons) para ver la lista de los boto\\hich\\af43\\dbch\\af31505\\loch\\f43 n\\hich\\af43\\dbch\\af31505\\loch\\f43 \n\\hich\\f43 es de tuiteo. Cuando, desde nuestro sitio web, visita otro sitio web que contiene este plug-in, el\" (Indicator: \"twitter\")\n \"onding page of our website. If you are logged in to your YouTube acco\nu\nnt, YouTube can assign your surfing behavior to your personal profile. You can prevent that by logging out of your YouTube account. We use YouTube to provide an appealing presentation of\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Modifies Software Policy Settings","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"msiexec.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"CabD1AE.tmp\" has type \"Microsoft Cabinet archive data 59134 bytes 1 file\"\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4795 bytes 1 file\"\n \"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data 59134 bytes 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"msiexec.exe\" at 00065733-00001088-00000033-14233598721909272\n \"msiexec.exe\" at 00066446-00001672-00000033-2138148\n \"msiexec.exe\" at 00073628-00002520-00000033-257151057","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\B520FC0F3F6DC7F439B93292F12578C5\\INSTALLPROPERTIES\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Creates new processes","description":"\"msiexec.exe\" is creating a new process (Name: \"%WINDIR%\\SysWOW64\\msiexec.exe\", Handle: )\n \"msiexec.exe\" is creating a new process","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"MSI8D89.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MSIFB35.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"msiexec.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"1.0.0.0\" found in string \"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"LROOT\\CIMV2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%WINDIR%\\System32\\msiexec.exe\" marked \"%TEMP%\\CabD1AE.tmp\" for deletion\n \"%WINDIR%\\System32\\msiexec.exe\" marked \"%TEMP%\\TarD1AF.tmp\" for deletion\n \"%WINDIR%\\System32\\msiexec.exe\" marked \"%WINDIR%\\Installer\\MSIFB35.tmp\" for deletion\n \"%WINDIR%\\System32\\msiexec.exe\" marked \"%WINDIR%\\Installer\\11eb95.msi\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"msiexec.exe\" opened \"%TEMP%\\CabD1AE.tmp\" with delete access\n \"msiexec.exe\" opened \"%TEMP%\\TarD1AF.tmp\" with delete access\n \"msiexec.exe\" opened \"%WINDIR%\\Installer\\MSIFB35.tmp\" with delete access\n \"msiexec.exe\" opened \"%WINDIR%\\Installer\\11eb95.msi\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$3d","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"msiexec.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"msiexec.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{000C103E-0000-0000-C000-000000000046}\\InProcServer32\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"msiexec.exe\" wrote 1500 bytes to a remote process \"%WINDIR%\\SysWOW64\\msiexec.exe\" (Handle: 420)\n \"msiexec.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\SysWOW64\\msiexec.exe\" (Handle: 420)\n \"msiexec.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\SysWOW64\\msiexec.exe\" (Handle: 420)\n \"msiexec.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\SysWOW64\\msiexec.exe\" (Handle: 420)\n \"msiexec.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\SysWOW64\\msiexec.exe\" (Handle: 420)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"suspicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\"msiexec.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\"; Key: \"DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\")\n \"msiexec.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"$3e","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\"msiexec.exe\" called \"RemoveDirectoryW\" with parameter C:\\MSI2d2c9.tmp (UID: 00000000-00006356)\n \"msiexec.exe\" called \"RemoveDirectoryW\" with parameter Z:\\MSI2d2ca.tmp (UID: 00000000-00006356)\n \"msiexec.exe\" called \"RemoveDirectoryW\" with parameter C:\\Config.Msi (UID: 00000000-00000736)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$3f","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"tdm,$EL)*A{JrSOidytp\" (Indicator: \"Oid\"; Source: \"00000000-00000736-00000BC1-159184856\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00000736.00000002.82905.23110000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006356.00000000.78565.1B6B0000.00000004.mdmp, 00000000-00006356.00000001.80484.1B6B0000.00000004.mdmp, 00000000-00006356.00000002.82407.1B6B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains long base64 encoded strings","description":"$43","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-500","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Creates inf file in Windows folder","description":"\"MsiExec.exe\" trying to write a file \"C:\\Windows\\System32\\DRVSTORE\\dokan_03786891CAD255A608C988D6263D8BF068E504FB\\dokan.inf\"","origin":"API Call","mitre_attack_id":"T1564.005","relevance":1,"id":"api-270","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000736.00000000.79067.C0EF0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000736.00000001.80985.C0EF0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00000736.00000002.82905.C0EF0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006356.00000000.78565.C0EF0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006356.00000001.80484.C0EF0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006356.00000002.82407.C0EF0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"MsiExec.exe\" renamed original file\"C:\\Windows\\System32\\drivers\\SET3D7.tmp\" to \"%WINDIR%\\system32\\DRIVERS\\dokan.sys\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from binary to string","description":"$44","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-230","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$45","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to create hash value of data","description":"$46","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-214","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$47","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic DLLs","description":"Found string \"%WINDIR%\\SysWOW64\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006356-00000C1E-83086539\")\n Found string \"%WINDIR%\\system32\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000736-00000BC1-140342110\")\n Found string \"C:\\?WINDOWS\\SysWOW64\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000736-00000BC1-140342403\")\n Found string \":\\WINDOWS\\SysWOW64\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains long base64 encoded strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains long base64 encoded strings\n Matched sigs: Contains reference to cryptographic DLLs\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - Cryptography Rijndael\n Matched sigs: YARA signature match - AES Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP urls in memory dumps\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Found potential IP address in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"msiexec.exe\" called \"GetWindowTextW\" (UID: 00000000-00006356)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Preparing to install...\" - (UID: 00000000-00006356)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00006356)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"&Back\" - (UID: 00000000-00006356)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"&Next\" - (UID: 00000000-00006356)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"&Print\" - (UID: 00000000-00006356)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"End-user License Agreement for Paragon Software ProductsThis End-User License Agreement (\" - (UID: 00000000-00006356)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"Please read the following license agreement carefully\" - (UID: 00000000-00006356)\n \"msiexec.exe\" called \"GetWindowTextW\" with parameter \"End-User License Agreement\" - (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"MsiExec.exe\" called \"GetActiveWindow\" (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"msiexec.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00006356)\n \"msiexec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"MsiExec.exe\" called \"RtlGetVersion\" with parameter 1c0100000600000000000000701700000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$48","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"MsiExec.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003680)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve default language settings","description":"\"msiexec.exe\" called \"GetSystemDefaultLangID\" (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-149","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"msiexec.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006356)\n \"MsiExec.exe\" called \"GetLocaleInfoW\" with parameter \"2057\" - (UID: 00000000-00006328)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM #_MsiRedirectedFile WHERE `Sequence` IS NOT NULL ORDER BY `Sequence`\" (Indicator: \"select * from \"; Source: \"00000000-00000736.00000002.82905.23110000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfo(LOCALE_SENGLANGUAGE)\" (Indicator: \"GetLocaleInfo\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"msiexec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"reg.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set last focus to %s(%s)\" (Indicator: \"set \"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")\n Found string \"Set of values that are permitted\" (Indicator: \"set \"; Source: \"00000000-00000736.00000002.82905.264C0000.00000004.mdmp\")\n Found string \"Set of values that are permitted\" (Indicator: \"set \"; Source: \"00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetMonitorInfo\" (Indicator: \"GetMonitorInfo\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")\n Found reference to API \"ExpandEnvironmentStrings\" (Indicator: \"ExpandEnvironmentStrings\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"79052500311,6268,109,,GetWindowTextW,user32.dll,\"00:20:56.437\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00006356.00000001.80484.1E040000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volatile registry keys","description":"\"msiexec.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"msiexec.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\0\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-139","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"reg.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$4d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"MsiExec.exe\" called \"CopyFileW\" to copy %TEMP%\\dokandrv10x64\\dokan.inf to new location %WINDIR%\\system32\\DRVSTORE\\dokan_03786891CAD255A608C988D6263D8BF068E504FB\\dokan.inf (UID: 00000000-00003680)\n \"MsiExec.exe\" called \"CopyFileW\" to copy %TEMP%\\dokandrv10x64\\dokan.cat to new location %WINDIR%\\system32\\DRVSTORE\\dokan_03786891CAD255A608C988D6263D8BF068E504FB\\dokan.cat (UID: 00000000-00003680)\n \"MsiExec.exe\" called \"CopyFileW\" to copy %TEMP%\\dokandrv10x64\\dokan.sys to new location %WINDIR%\\system32\\DRVSTORE\\dokan_03786891CAD255A608C988D6263D8BF068E504FB\\dokan.sys (UID: 00000000-00003680)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$4e","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"MsiExec.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\SysWOW64\\reg.exe\" COPY \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\ExtFS for Windows\" \"HKEY_LOCAL_MACHINE\\SOFTWARE\\P\" - (UID: 00000000-00002092), \"MsiExec.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\SysWOW64\\reg.exe\" DELETE \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\ExtFS for Windows\" /reg:32 /f\" - (UID: 00000000-00002092), \"MsiExec.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\SysWOW64\\reg.exe\" ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\paragon_servic\" - (UID: 00000000-00002092)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"MsiExec.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00002092)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$4f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$50","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"Found reference to native API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to native API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$51","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"sleep at 50475-377-000000010044DD90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$54","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"Install just for you ([LogonUser])\" (Indicator: \"LogonUser\"; Source: \"00000000-00000736.00000002.82905.23110000.00000004.mdmp\")\n Found reference to API \"LogonUser\" (Indicator: \"LogonUser\"; Source: \"00000000-00000736.00000002.82905.268B0000.00000004.mdmp\")\n Found reference to API \"Install just for you ([LogonUser])\" (Indicator: \"LogonUser\"; Source: \"00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$58","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"msiexec.exe\" failed to load missing module \"%WINDIR%\\system32\\TSAPPCMP.DLL\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$59","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$5a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$5b","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$5c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 57090000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 56AE0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74570000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72F60000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 57090000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 56AE0000\n \"reg.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74570000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 38670000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 58AE0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 774B0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 58AE0000\n \"reg.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 774B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c72d57fb7f0000@ntdll.dll\"\n \"220023000000000018c72d57fb7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$5d","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\msiexec.exe\" [Source: 00000000-00000736-00000BC1-137228047]\n Observed system executable string:\"%WINDIR%\\SysWOW64\\reg.exe\" [Source: 00000000-00002092-00000BC0-146722917]\n Observed system executable string:\"\"%WINDIR%\\SysWOW64\\reg.exe\" COPY \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\ExtFS for Windows\" \"HKEY_LOCAL_MACHINE\\SOFTWARE\\P\" [Source: 00000000-00002092-00000C3A-3967533204], Observed system executable string:\"\"%WINDIR%\\SysWOW64\\reg.exe\" DELETE \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\ExtFS for Windows\" /reg:32 /f\" [Source: 00000000-00002092-00000C3A-7850989902], Observed system executable string:\"\"%WINDIR%\\SysWOW64\\reg.exe\" ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\paragon_servic\" [Source: 00000000-00002092-00000C3A-12420502672]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Reads configuration files (.ini files)","description":"\"msiexec.exe\" reads file \"C:\\Windows\\win.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Tries to copy files","description":"Process \"reg.exe\" with commandline \"COPY \"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Paragon Software\\\\ExtFS for Windows\" \"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Paragon Software\\\\Linux File Systems for Windows by Paragon Software\" /reg:32 /s /f\" (UID: 00000000-00003648)","origin":"Monitored Target","mitre_attack_id":"T1570","relevance":3,"id":"target-291","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$60","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"msiexec.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MSI47E9.tmp\"\n \"msiexec.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MSI1750.tmp\"\n \"msiexec.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MSI1974.tmp\"\n \"msiexec.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MSI2F7E.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\"reg.exe\" allocated memory in \"%WINDIR%\\SysWOW64\\reg.exe\" with (Protection: \"read/write\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"$61","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops a Windows setup information (INF) file","description":"\"dokan.inf\" has type \"Windows setup INFormation\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-55","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$63","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"reg.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\reg.exe\" (UID: 880)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$64","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$65","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"msiexec.exe\" trying to access LNK file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\LINUX FILE SYSTEMS FOR WINDOWS BY PARAGON SOFTWARE\\LINUX FILE SYSTEMS FOR WINDOWS BY PARAGON SOFTWARE.LNK\"\n \"msiexec.exe\" trying to access LNK file \"C:\\Users\\Public\\Desktop\\LINUX FILE SYSTEMS FOR WINDOWS BY PARAGON SOFTWARE.LNK\"\n \"msiexec.exe\" trying to access LNK file \"%PUBLIC%\\Desktop\\LINUX FILE SYSTEMS FOR WINDOWS BY PARAGON SOFTWARE.LNK\"\n \"msiexec.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\LINUX FILE SYSTEMS FOR WINDOWS BY PARAGON SOFTWARE\\LINUX FILE SYSTEMS FOR WINDOWS BY PARAGON SOFTWARE.LNK\"\n \"msiexec.exe\" trying to access LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Linux File Systems for Windows by Paragon Software\\LINUX FILE SYSTEMS FOR WINDOWS BY PARAGON SOFTWARE.LNK\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"msiexec.exe\" trying to access non-existent file \"C:\\Windows\\System32\\OnDemandConnRouteHelper.dll\"\n \"msiexec.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CLR.DLL\"\n \"msiexec.exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\UCRTBASE_CLR0400.DLL\"\n \"MsiExec.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"MsiExec.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"\n \"MsiExec.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\wbem\\WBEMCOMN.DLL\"\n \"reg.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$66","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$67","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"msiexec.exe\" writes a file \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ngen.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create string binding handle (RPC)","description":"\"msiexec.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-218","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register protocol sequence (RPC)","description":"$68","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-220","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"MsiExec.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"340c970\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"\n \"$error\": \"2efd\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy files","description":"Observed string: \"COPY \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\ExtFS for Windows\" \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\Linux File Systems for Windows by Paragon Software\" /reg:32 /s /f\" (Indicator: \"copy \") in Source: reg.exe","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-329","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to identify remote systems","description":"Found string \"ping CA09E\" (Indicator: \"ping \"; Source: \"00000000-00006356.00000001.80484.1DF40000.00000004.mdmp, 00000000-00006356.00000002.82407.1DF40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Network Related","name":"Found potential IP urls in memory dumps","description":"$69","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-3","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$6a","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on file \"Updater.exe\"\n YARA signature for AES encryption matched on file \"Linux File Systems for Windows by Paragon Software.exe\"\n YARA signature for AES encryption matched on file \"ParagonLinuxFSforWindows.exe\"\n YARA signature for AES encryption matched on file \"MSI9416.tmp\"\n YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on file \"paragon_service.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Embedded Pdf document","description":"YARA signature for Embedded Pdf matched on file \"Qt5Gui.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":1,"id":"yara-33","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"$6b","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$6d","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"\"reg.exe\" called \"NtQueryAttributesFile\" with parameters {\"ProcessHandle\": \"4294967295\"\n \"FileInformationClass\": \"4\"\n \"Length\": \"40\"\n \"ShareAccess\": \"7\"\n \"CreateDisposition\": \"1\"\n \"CreateOptions\": \"2097152\"\n \"$name\": \"C:\\\\windows\\\\temp\\\\VxOle32.dll\"\n \"$va_req\": \"4f0000\"\n \"$va_krn\": \"4f0000\"}\n \"reg.exe\" called \"NtQueryAttributesFile\" with parameters {\"$name\": \"C:\\\\WINDOWS\\\\system32\\\\IMM32.DLL\"}\n \"reg.exe\" called \"NtQueryAttributesFile\" with parameters {\"$name\": \"C:\\\\WINDOWS\\\\system32\\\\oleaut32.dll\"}\n \"reg.exe\" called \"NtQueryAttributesFile\" with parameters {\"$name\": \"C:\\\\WINDOWS\\\\SYSTEM32\\\\kernelbase.dll\"}\n \"reg.exe\" called \"NtQueryAttributesFile\" with parameters {\"$name\": \"C:\\\\WINDOWS\\\\SYSTEM32\\\\ole32.dll\"}\n \"reg.exe\" called \"NtQueryAttributesFile\" with parameters {\"$name\": \"C:\\\\windows\\\\temp\\\\VxOle32.dll\"}","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"msiexec.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}\n \"msiexec.exe\" called \"GetKeyState\" (UID: 00000000-00006356)","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"msiexec.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"msiexec.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00000736)\n \"MsiExec.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"reg.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"$6e","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"\"reg.exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"4\"\n \"OpenAsSelf\": \"1\"\n \"TokenHandle\": \"8976034972041216\"\n \"$status\": \"c000007c\"}\n \"reg.exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"4\"\n \"OpenAsSelf\": \"1\"\n \"TokenHandle\": \"51755421068689408\"\n \"$status\": \"c000007c\"}\n \"reg.exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"4\"\n \"OpenAsSelf\": \"1\"\n \"TokenHandle\": \"24731864799379456\"\n \"$status\": \"c000007c\"}\n \"reg.exe\" called \"NtOpenThreadToken\" with parameters {\"ThreadHandle\": \"4294967294\"\n \"DesiredAccess\": \"4\"\n \"OpenAsSelf\": \"1\"\n \"TokenHandle\": \"64138876934946816\"\n \"$status\": \"c000007c\"}","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"msiexec.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}\n \"MsiExec.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00006328)\n \"MsiExec.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$6f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE `Dialo\" (Indicator: \"where \"; Source: \"00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"can't use wxGetKeyState() for mouse buttons\" (Indicator: \"GetKeyState\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"eGetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password to run service with. (with StartName)\" (Indicator: \"password\"; Source: \"00000000-00000736.00000002.82905.264C0000.00000004.mdmp, 00000000-00000736.00000002.82905.288B0000.00000004.mdmp\")\n Found string \"password to run service with. (with StartName)\" (Indicator: \"password\"; Source: \"00000000-00006356.00000001.80484.1E040000.00000004.mdmp, 00000000-00006356.00000002.82407.1E040000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"msiexec.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006356)\n \"msiexec.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\apppatch\\msimain.sdb\" (UID: 00000000-00006356), \"msiexec.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Users\\HAPUBWS\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F4EA555947766F67C3BB52DEDFD509C5\" (UID: 00000000-00006356)\n \"msiexec.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000736)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to terminate process and its threads","description":"\"msiexec.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\WINDOWS\\\\System32\\\\msiexec.exe\"}\n \"msiexec.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\WINDOWS\\\\system32\\\\msiexec.exe\"}\n \"MsiExec.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\Windows\\\\syswow64\\\\MsiExec.exe\"}\n \"MsiExec.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\Windows\\\\System32\\\\MsiExec.exe\"}\n \"reg.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\WINDOWS\\\\SysWOW64\\\\reg.exe\"}\n \"WerFault.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\WINDOWS\\\\SysWOW64\\\\WerFault.exe\"}","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-247","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$76","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookEx(wxKeyboardHook)\" (Indicator: \"SetWindowsHook\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")\n Found reference to API \"SetWindowsHookEx(WH_GETMESSAGE)\" (Indicator: \"SetWindowsHook\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"$7a","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfo(GETWHEELSCROLLLINES)\" (Indicator: \"SystemParametersInfo\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")\n Found reference to API \"SystemParametersInfo(SPI_GETNONCLIENTMETRICS)\" (Indicator: \"SystemParametersInfo\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")\n Found reference to API \"SystemParametersInfo(SPI_GETICONTITLELOGFONT\" (Indicator: \"SystemParametersInfo\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000736.00000000.79067.C0EFA000.00000002.mdmp, 00000000-00000736.00000001.80985.C0EFA000.00000002.mdmp, 00000000-00000736.00000002.82905.C0EFA000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006356.00000000.78565.C0EFA000.00000002.mdmp, 00000000-00006356.00000001.80484.C0EFA000.00000002.mdmp, 00000000-00006356.00000002.82407.C0EFA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$7d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to map section into the virtual address space of a process","description":"$7e","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-259","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found string \"winlogon.exe\" (Indicator: \"services.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\"; Source: \"00000000-00000736.00000002.82905.268B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"MSI47E9.tmp\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\MSI47E9.tmp]- [targetUID: 00000000-00006328]\n \"dokan.sys\" has type \"PE32+ executable (native) x86-64 for MS Windows\"- Location: [%TEMP%\\dokandrv10x64\\dokan.sys]- [targetUID: 00000000-00003680]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$7f","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"msiexec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"reg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")\n Found string \"Please update your dbghelp.dll version, at least version 5.1 is needed!(if you already have a new version, please put it in the same directory where the program is.)\" (Indicator: \"dbghelp.dll\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")\n Found string \"Please install dbghelp.dll available free of charge from Microsoft to get more detailed crash information!\" (Indicator: \"dbghelp.dll\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")\n Found string \"Latest dbghelp.dll is available at http://www.microsoft.com/whdc/ddk/debugging/\" (Indicator: \"dbghelp.dll\"; File: \"9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79.msi.bin\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"reg.exe queries ProcessDebugPort (UID: 880)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"msiexec.exe\" called \"FileTimeToLocalFileTime\" with parameter 00cfa8452ef5d601 & 00cfa8452ef5d601 (UID: 00000000-00006356)\n \"msiexec.exe\" called \"FileTimeToLocalFileTime\" with parameter 00cfa8452ef5d601 & 00cfa8452ef5d601 (UID: 00000000-00000736)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.dll at 50475-343-000000010044DFB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com0\"\n Pattern match: \"v@g.zngdzg\"\n Pattern match: \"support@paragon-software.com\"\n Pattern match: \"dsba2018@paragon-software.com\"\n Pattern match: \"info@paragon-software.com\"\n Pattern match: \"_@b._\"\n Pattern match: \"www.paragon@software.com\"\n Pattern match: \"4@4.444j4p4j4p4j4p4j4p4j4p4.444.444.444.444\"\n Pattern match: \"4@3b3h4.443b3h4.443n3t4j4p3n3t4j4p3\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"The input sample dropped/contains a certificate file","description":"$80","origin":"Binary File","mitre_attack_id":"T1588.004","relevance":10,"id":"binary-12","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$81","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"\\hich\\af1\\dbch\\af31505\\loch\\f1 y\\hich\\af1\\dbch\\af31505\\loch\\f1 pe/version,\\line \\bullet the operating system of your computer,\\line \\bullet Referrer-URL (the website from which access is made),\\line \\bullet hostname of the accessing computer\\line\" (Indicator: \"hostname\"; Source: \"00000000-00000736.00000002.82905.264C0000.00000004.mdmp\")\n Found string \"ping CA09E\" (Indicator: \"ping\"; Source: \"00000000-00006356.00000001.80484.1DF40000.00000004.mdmp, 00000000-00006356.00000002.82407.1DF40000.00000004.mdmp\")\n Found string \"\\hich\\af1\\dbch\\af31505\\loch\\f1 y\\hich\\af1\\dbch\\af31505\\loch\\f1 pe/version,\\line \\bullet the operating system of your computer,\\line \\bullet Referrer-URL (the website from which access is made),\\line \\bullet hostname of the accessing computer\\line\" (Indicator: \"hostname\"; Source: \"00000000-00006356.00000001.80484.1F470000.00000004.mdmp, 00000000-00006356.00000002.82407.1F470000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"MsiExec.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"$82","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops system driver","description":"\"SET3D7.tmp\" has type \"PE32+ executable (native) x86-64 for MS Windows\"\n \"dokan.sys\" has type \"PE32+ executable (native) x86-64 for MS Windows\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-2","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73760000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"malicious","category":"Network Related","name":"Making HTTPS connections using insecure TLS/SSL version","description":"Connection was made using TLSv1.1 [tls.handshake.version: 0x00000302]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":10,"id":"network-53","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"Bolonyokte\" classified file \"sample.bin\" as \"rat\" (Author: Jean-Philippe Teissier / @Jipe_)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"malicious","category":"System Security","name":"Tries to delete registry keys using reg.exe","description":"Process \"reg.exe\" with commandline \"DELETE \"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Paragon Software\\\\ExtFS for Windows\" /reg:32 /f\" (UID: 00000000-00001536)","origin":"Monitored Target","mitre_attack_id":"T1112","relevance":5,"id":"target-24","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$83","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]}]},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":164,"dropped_files_count":0,"extracted_files_count":40,"files_written_count":195,"files_deleted_count":0,"registry_keys_created_count":33,"registry_keys_modified_count":0,"registry_keys_deleted_count":11,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":44,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files","Sample Crashed","Simulated analysis"],"sandbox_reports":[{"id":"646941f09be9a6dbca00afc8","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"Setup.msi","analysis_start_time":"2023-05-20T21:56:03+00:00","indicators_count":{"informative":177,"suspicious":38,"malicious":7},"tags":["Multi-Process","Extracted Files","Sample Crashed","Simulated analysis"],"is_in_unified_schema":true},{"id":"602aba7b0afbc07fe93aff64","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"linuxwin_trial.msi","analysis_start_time":"2021-02-15T18:16:34+00:00","indicators_count":{"informative":30,"suspicious":14,"malicious":4},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"60159adbae047206ee566c4a","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"Setup.msi","analysis_start_time":"2021-01-31T10:25:47+00:00","indicators_count":{"informative":31,"suspicious":14,"malicious":4},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}],"processes":[{"pid":6356,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\Setup.msi\"","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00006356","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":736,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00000736","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":6328,"ppid":736,"name":"MsiExec.exe","command_line":"-Embedding 197E499F086F6C7C8B24B99A76AB8ED0 C","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00000736","uid":"00000000-00006328"},{"pid":3844,"ppid":736,"name":"MsiExec.exe","command_line":"-Embedding 00BC93EB25BD47F9A5D22B85177E67A7","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00000736","uid":"00000000-00003844"},{"pid":3760,"ppid":736,"name":"MsiExec.exe","command_line":"-Embedding 1E333B6186591A0742F9D0E26ED28869","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00000736","uid":"00000000-00003760"},{"pid":2092,"ppid":736,"name":"MsiExec.exe","command_line":"-Embedding A902383DCEF83412E7F582E7B27F5358 E Global\\MSI0000","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00000736","uid":"00000000-00002092"},{"pid":3648,"ppid":2092,"name":"reg.exe","command_line":"COPY \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\ExtFS for Windows\" \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\Linux File Systems for Windows by Paragon Software\" /reg:32 /s /f","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00002092","uid":"00000000-00003648"},{"pid":1536,"ppid":2092,"name":"reg.exe","command_line":"DELETE \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Paragon Software\\ExtFS for Windows\" /reg:32 /f","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00002092","uid":"00000000-00001536"},{"pid":880,"ppid":2092,"name":"reg.exe","command_line":"ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\paragon_service.exe\" /f /reg:64 /v DumpFolder /t REG_EXPAND_SZ /d \"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\crashdumps\"","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00002092","uid":"00000000-00000880"},{"pid":6108,"ppid":880,"name":"WerFault.exe","command_line":"-u -p 880 -s 228","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000880","uid":"00000000-00006108"},{"pid":3424,"ppid":880,"name":"WerFault.exe","command_line":"-u -p 880 -s 224","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00000880","uid":"00000000-00003424"},{"pid":4800,"ppid":2092,"name":"reg.exe","command_line":"ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\paragon_service.exe\" /f /reg:64 /v DumpType /t REG_DWORD /d 1","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00002092","uid":"00000000-00004800"},{"pid":3068,"ppid":2092,"name":"reg.exe","command_line":"ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\paragon_service.exe\" /f /reg:64 /v DumpCount /t REG_DWORD /d 16","sha256":"405a70c2b6081e6fed2a4bab7b0c233fff022acbbb3d2cc92cb8876d052db9e4","normalized_path":"%WINDIR%\\SysWOW64\\reg.exe","parent_uid":"00000000-00002092","uid":"00000000-00003068"},{"pid":3680,"ppid":736,"name":"MsiExec.exe","command_line":"-Embedding A456E89102B74EB5AE059C8CEA8C918E E Global\\MSI0000","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00000736","uid":"00000000-00003680"}],"all_imported_dlls":["wow64win.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","apphelp.dll","wintrust.dll","Wldap32.dll","webio.dll","spp.dll","sechost.dll","imm32.dll","vsstrace.dll","winmm.dll","api-ms-win-downlevel-version-l1-1-0.dll","profapi.dll","clbcatq.dll","api-ms-win-core-synch-l1-2-0.dll","msvcrt.dll","msi.dll","cryptsp.dll","rsaenh.dll","cryptbase.dll","SensApi.dll","normaliz.dll","gpapi.dll","dhcpcsvc6.dll","winhttp.dll","comdlg32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","riched20.dll","dwmapi.dll","crypt32.dll","msacm32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","user32.dll","msimsg.dll","wow64.dll","atl.dll","api-ms-win-downlevel-user32-l1-1-0.dll","wininet.dll","uxtheme.dll","mswsock.dll","RstrtMgr.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","VxSSL64.dll","oleaut32.dll","credssp.dll","wship6.dll","mscoree.dll","msvcp140.dll","dnsapi.dll","samcli.dll","iertutil.dll","shell32.dll","vcruntime140.dll","wow64cpu.dll","ole32.dll","nsi.dll","winsta.dll","urlmon.dll","usp10.dll","sfc.dll","FWPUCLNT.DLL","advapi32.dll","cabinet.dll","rpcss.dll","rpcrt4.dll","mscoreei.dll","clr.dll","msctf.dll","srvcli.dll","srclient.dll","AcGenral.dll","lpk.dll","propsys.dll","bcrypt.dll","msls31.dll","KernelBase.dll","gdi32.dll","mpr.dll","cryptnet.dll","ws2_32.dll","wkscli.dll","devrtl.dll","version.dll","devobj.dll","AcLayers.dll","msihnd.dll","dhcpcsvc.dll","cfgmgr32.dll","ntmarta.dll","winnsi.dll","sxs.dll","vccorlib140.dll","sspicli.dll","msasn1.dll","IPHLPAPI.DLL","netapi32.dll","RpcRtRemote.dll","ntdll.dll","kernel32.dll","sfc_os.dll","msisip.dll","fusion.dll","shlwapi.dll","userenv.dll","vssapi.dll","vss_ps.dll","bcryptprimitives.dll","netutils.dll","rasadhlp.dll","comctl32.dll","setupapi.dll","ncrypt.dll","WSHTCPIP.DLL","mfc140chs.dll","mfcm140.dll","mfc140u.dll","mfc140rus.dll","wshqos.dll","vcamp140.dll","mfc140.dll","mfc140fra.dll","concrt140.dll","kernel.appcore.dll","d3d11.dll","dxgi.dll","pcacli.dll","wbemsvc.dll","windows.storage.dll","taskschd.dll","wldp.dll","schannel.dll","CoreMessaging.dll","VxSSL32.dll","drvstore.dll","ucrtbase.dll","WinTypes.dll","spfileq.dll","TextInputFramework.dll","rmclient.dll","gdi32full.dll","fltLib.dll","SHCore.dll","OnDemandConnRouteHelper.dll","vcruntime140_clr0400.dll","ntasn1.dll","combase.dll","coml2.dll","WindowsCodecs.dll","msvcp_win.dll","cldapi.dll","wbemprox.dll","wbemcomn.dll","fastprox.dll","CoreUIComponents.dll","win32u.dll","powrprof.dll","xmllite.dll","srpapi.dll","dcomp.dll","ucrtbase_clr0400.dll","spinf.dll","DataExchange.dll","msimg32.dll","twinapi.appcore.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"TarD1AF.tmp","sha256":"bb899286be1709a14630dc5ed80b588fdd872db361678d3105b0ace0d1ea6745","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"name":"MSIFB35.tmp","sha256":"a2e3a23f5e70c66f55abdc38892bf91e534c4b8294a645f4286eace190047c0b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"name":"MSI8D89.tmp","sha256":"097f1c3f27b18010448d77e3f70c4d9f774cb9c5ab435c62baa1c00e4cadd5ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"58a4f38ba43f115ba3f465c311eaaf67f43d92e580f7f153de3ab605fc9900f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5","sha256":"6cbc2916f8ff16127a5035a84af7cc7645738ef539ab19d3af982e143a41886d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"3f6d7add5c022422e5c642feeff7f1596dc0314564b9dfd01e279f2578c32b60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"name":"66AE3BFDF94A732B262342AD2154B86E_2F4E03F10A4A01EDF8DD2FCAF5862404","sha256":"a55dafa87d555a7612bc49da2ca80d8c26c4a775a3893d07f8cb1d36c0e0690f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"CabD1AE.tmp","sha256":"58a4f38ba43f115ba3f465c311eaaf67f43d92e580f7f153de3ab605fc9900f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"name":"MSIC2EF.tmp","sha256":"a2e3a23f5e70c66f55abdc38892bf91e534c4b8294a645f4286eace190047c0b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"name":"MSI4DBF.tmp","sha256":"097f1c3f27b18010448d77e3f70c4d9f774cb9c5ab435c62baa1c00e4cadd5ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"name":"dokan.dll","sha256":"dcac45084b266d81597654ce532c8a29bf3675eed52c7ea386bb87fd371f8153","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"Qt5Core.dll","sha256":"48e3dcd25f400add1e761887d8945f392a51673382970655470b9bdf1786ccbd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"extmounter.exe","sha256":"775a02648424d478f4cbb0719e762e550971ed10e8c4617cffd0a69fbd21c1e2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"paragon_service.exe","sha256":"89362668160bdf9a783c70eb00af236a187d19c79da6e7f9f4b55d34166f4cb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"qwindows.dll","sha256":"cb953c4e44b50e65cfee13856bb750ec4e7617add05a956cc0b9eb430eec5937","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"e2fsck.exe","sha256":"9e6b6af8d37450aea015c2806869925c0ec4a7409e6f313f3ce7f63dc03d7ccd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"mke2fs.exe","sha256":"dfb8e6ee0afc6f0115abf425f00c9c3866548b0a9ef40abeef2e8433b9c00f20","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"dokan.cat","sha256":"5c592eb0d67b5ff7b49d7393e3958f67b26a297e16e32fbae1f8a4711f2c7872","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"ParagonLinuxFSforWindows.exe","sha256":"a0282255b6462981eda5bb5e54c5e4d03e0b644cb262f6593c82cc9b0bc9a85d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"Qt5Gui.dll","sha256":"b512b1501e06de73bb7bb9092b5a90951ed1fbb6f7907a24e7df59dca58a0846","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"Qt5Widgets.dll","sha256":"8d0c4596da10e925eb81f84a703efe47e127c1181a0ec5b7d40bdb894cabc136","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"cygwin1.dll","sha256":"64760e41402824af3fddd704282f495007f0d1fcb7862c0a0ca1f8128ce1daec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"Linux File Systems for Windows by Paragon Software.exe","sha256":"a0282255b6462981eda5bb5e54c5e4d03e0b644cb262f6593c82cc9b0bc9a85d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"fsdump.exe","sha256":"1d919fe925aa05593d238db968553ac71328b56b975c633b4898bb7018e1c535","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"Updater.exe","sha256":"f03b8b0e4358fbe03180750906c17789b4f386d83c5c0b786736d1bfee96f9a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"mklost_found.exe","sha256":"ece0ab974ca2490b53f87b70fcf39352cb546aa30c8a1f84d96b8ca001f5f49b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"0E506CEBBC8B162CFB2D72DB4891DCAE","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"42B9A473B4DAF01285A36B4D3C7B1662_38924EDF39D8802D6946FB22E5DD0835","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"42B9A473B4DAF01285A36B4D3C7B1662_CAF45FDC3736D8D4B3A07D258CEC8D47","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"4D8404427A196184A4B981C5CCDA3643","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"616AD1AB067CFD351D6C0EF6F3E12F40","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"66AE3BFDF94A732B262342AD2154B86E_1C72B0D0B477924E3F62D28A4D4FDF1F","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"72EEF18E0160F79A0810E7AE28BBCBAC","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"782D7E2BFB036A849A99FFA65C652D39","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"F4EA555947766F67C3BB52DEDFD509C5","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"FC68FB72D4FBC7E0F151BC2282D75E47_367FA2447481C3DB640CE44BE2E5A181","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"FC68FB72D4FBC7E0F151BC2282D75E47_EB1C5E06BF3344F593EDE146B267D980","sha256":"f0a3eec2709682107edae2372e8984e15bd3b2b7e3de9878ba76cd69cc556ce0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"dokan.inf","sha256":"05aa6cf4bc3630893b3f29fc2cc5744cf396f0967a558c8f6e0e6a586a3ebfd5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"name":"Linux File Systems for Windows by Paragon Software.lnk","sha256":"e17f217f061353c81b8618bd0fa810c02073734115013aad6ea046c98e78348d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]}],"files_written":[{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\System32\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\en-US\\msiexec.exe.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\en-US\\winhttp.dll.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\66AE3BFDF94A732B262342AD2154B86E_1C72B0D0B477924E3F62D28A4D4FDF1F","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0E506CEBBC8B162CFB2D72DB4891DCAE","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\System32\\msiexec.exe.config","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\AppPatch\\msimain.sdb","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\sxs.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\en-US\\sxs.dll.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\ar-SA\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\bg-BG\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\cs-CZ\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\da-DK\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\de-DE\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\el-GR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\en\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\es-ES\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\et-EE\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\fi-FI\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\fr-FR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\he-IL\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\hr-HR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\hu-HU\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\it-IT\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\ja-JP\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\ko-KR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\lt-LT\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\lv-LV\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\nb-NO\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\nl-NL\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\pl-PL\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\pt-BR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\pt-PT\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\ro-RO\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\ru-RU\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\sk-SK\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\sl-SI\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\sr-Latn-CS\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\sv-SE\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\th-TH\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\tr-TR\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\uk-UA\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\zh-CN\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\zh-HK\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\system32\\zh-TW\\sxs.DLL.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\system32\\msiexec.exe.config","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\fusion.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\system32\\en\\MsiMsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\SysWOW64\\vccorlib140.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\SysWOW64\\msvcp140.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\SysWOW64\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\SysWOW64\\msiexec.exe","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msiexec.exe.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\782D7E2BFB036A849A99FFA65C652D39","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\616AD1AB067CFD351D6C0EF6F3E12F40","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\F4EA555947766F67C3BB52DEDFD509C5","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\System32\\en\\MsiMsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\SysWOW64\\advapi32.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\System32\\msimsg.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\en-US\\msimsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\66AE3BFDF94A732B262342AD2154B86E_2F4E03F10A4A01EDF8DD2FCAF5862404","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\66AE3BFDF94A732B262342AD2154B86E_2F4E03F10A4A01EDF8DD2FCAF5862404","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\SysWOW64\\concrt140.dll","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\fusion.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfcm140.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfc140u.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfc140.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\vccorlib140.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\concrt140.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\msvcp140.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"},{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\System32\\mfc140rus.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfc140kor.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfc140jpn.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfc140ita.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfc140fra.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfc140esn.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfc140enu.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfc140deu.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfc140cht.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfc140chs.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\vcamp140.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\mfcm140u.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%WINDIR%\\System32\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\42B9A473B4DAF01285A36B4D3C7B1662_AB5EAAA21DF673505B87D680AC76B6E1","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\782D7E2BFB036A849A99FFA65C652D39","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\616AD1AB067CFD351D6C0EF6F3E12F40","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\66AE3BFDF94A732B262342AD2154B86E_1C72B0D0B477924E3F62D28A4D4FDF1F","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\0E506CEBBC8B162CFB2D72DB4891DCAE","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\F4EA555947766F67C3BB52DEDFD509C5","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\42B9A473B4DAF01285A36B4D3C7B1662_38924EDF39D8802D6946FB22E5DD0835","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\42B9A473B4DAF01285A36B4D3C7B1662_38924EDF39D8802D6946FB22E5DD0835","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\42B9A473B4DAF01285A36B4D3C7B1662_CAF45FDC3736D8D4B3A07D258CEC8D47","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\42B9A473B4DAF01285A36B4D3C7B1662_CAF45FDC3736D8D4B3A07D258CEC8D47","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\FC68FB72D4FBC7E0F151BC2282D75E47_367FA2447481C3DB640CE44BE2E5A181","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\FC68FB72D4FBC7E0F151BC2282D75E47_367FA2447481C3DB640CE44BE2E5A181","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\FC68FB72D4FBC7E0F151BC2282D75E47_EB1C5E06BF3344F593EDE146B267D980","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\FC68FB72D4FBC7E0F151BC2282D75E47_EB1C5E06BF3344F593EDE146B267D980","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DFFA29A37BCC9EC62A.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\SourceHash{F0CF025B-D6F3-4F7C-939B-23291F52875C}","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DF0A7418328E7A3A36.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DF257AB12EBE9FBE49.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DF2FE5CF734E2F97F0.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"C:\\Config.Msi\\MSIB996.tmp","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\dokan.dll","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\utils\\e2fsck.exe","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\extmounter.exe","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\utils\\mke2fs.conf","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\utils\\mke2fs.exe","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\utils\\mke2fs-hurd.conf","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\utils\\mklost+found.exe","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\paragon_service.exe","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\Qt5Core.dll","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\qtbase.qm","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PROGRAMFILES%\\(x86)\\Paragon Software\\LinuxFS for Windows\\platforms\\qwindows.dll","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\concrt140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140chs.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140cht.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140deu.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140enu.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140esn.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140fra.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140ita.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140jpn.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140kor.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140rus.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfc140u.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfcm140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\mfcm140u.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\msvcp140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\vccorlib140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Installer\\$PatchCache$\\Managed\\B520FC0F3F6DC7F439B93292F12578C5\\5.2.1146\\vcruntime140.dll.41084701_5F61_3497_AC5D_D0A6D4A85536","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%PUBLIC%\\Desktop","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\System32\\DRVSTORE","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\System32\\catroot2\\dberr.txt","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DF3A4AB2613532DEAA.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DF8D8B57F6E2E57CA1.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DF0A212601AFB5ADE8.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DF4E1B550383F4E587.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%ALLUSERSPROFILE%\\Paragon\\LinuxFS for Windows\\LIC","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%ALLUSERSPROFILE%\\Paragon\\LinuxFS for Windows\\LIC:rmb","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%ALLUSERSPROFILE%\\Paragon\\LinuxFS for Windows\\LIC:redeem","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%ALLUSERSPROFILE%\\Paragon\\LinuxFS for Windows\\LIC:usid","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%ALLUSERSPROFILE%\\Paragon\\LinuxFS for Windows\\LIC:sid","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DF25D87C5E6987610B.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DF596EBFA4B0C19E20.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DF22CE095BC1FCDA43.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%WINDIR%\\Temp\\~DFAE9448AE8BAB46F6.TMP","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCR\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\SECURE\\","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\VSS\\DIAG\\","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\VSS\\DIAG\\SPP\\","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\VSS\\DIAG\\SYSTEMRESTORE\\","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\COMPONENTS\\{591533B2-E8D2-4241-9C3D-55848451635D}\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\COMPONENTS\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\WINDOWS ERROR REPORTING\\LOCALDUMPS\\PARAGON_SERVICE.EXE\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\COMPONENTS\\{591533B2-E8D2-4241-9C3D-55848451635D}\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\COMPONENTS\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFX\\DRIVERSTORE\\DOKAN_03786891CAD255A608C988D6263D8BF068E504FB\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFX\\SERVICES\\DOKAN\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFX\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFX\\SERVICES\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKLMHKLM\\DRIVERS\\DRIVERDATABASE\\DRIVERINFFILES\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SEQUENCE\\SEQUENCE","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\SESSIONHASH\\SESSIONHASH","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\OWNER\\OWNER","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\COMPONENTS\\{591533B2-E8D2-4241-9C3D-55848451635D}\\CLEANUPNEEDED\\CLEANUPNEEDED","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\COMPONENTS\\{591533B2-E8D2-4241-9C3D-55848451635D}\\NOROLLBACK\\NOROLLBACK","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\COMPONENTS\\{591533B2-E8D2-4241-9C3D-55848451635D}\\CONNECTHARDWARE\\CONNECTHARDWARE","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\COMPONENTS\\{591533B2-E8D2-4241-9C3D-55848451635D}\\REBOOT\\REBOOT","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\COMPONENTS\\{591533B2-E8D2-4241-9C3D-55848451635D}\\UNINSTALLERROR\\UNINSTALLERROR","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\COMPONENTS\\{591533B2-E8D2-4241-9C3D-55848451635D}\\","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\DIFXAPP\\COMPONENTS\\{591533B2-E8D2-4241-9C3D-55848451635D}\\SYMBOLICLINKVALUE\\SYMBOLICLINKVALUE","sources":[{"report_type":"sandbox","report_id":"646941f09be9a6dbca00afc8"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"name":"\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"60159adbae047206ee566c4a"},{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"602aba7b0afbc07fe93aff64"}]}]}},"report_ids":{"sandbox_job_ids":["646941f09be9a6dbca00afc8","60159adbae047206ee566c4a","602aba7b0afbc07fe93aff64"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Sample 9616cb50bfce… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9616cb50bfce…. Threat score 100/100. 0/0 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 9616cb50bfce… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9616cb50bfce…. Threat score 100/100. 0/0 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9616cb50bfceb40e36f9b33f464e3ce6e16afc938d81f8f72e1862e3c8c3ec79"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 9616cb50bfce… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9616cb50bfce…. Threat score 100/100. 0/0 AV engines flagged this file. 9 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L84","11",{}]] 32:null