24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] a7:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4f9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 9956d4433d4b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9956d4433d4b…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 20/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757"],"about":{"@type":"SoftwareApplication","name":"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","applicationCategory":["peexe","executable"],"identifier":"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7d2,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")26:T4c1,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "FindResourceA" with parameter "3585" - (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "FindResourceA" with parameter "102" - (UID: 00000000-00002948) "NTKA.exe" called "FindResourceA" with parameter "3585" - (UID: 00000000-00005916) "NTKA.exe" called "FindResourceA" with parameter "102" - (UID: 00000000-00005916) "SHLSGCM.exe" called "FindResourceA" with parameter "3585" - (UID: 00000000-00007192) "SHLSGCM.exe" called "FindResourceA" with parameter "102" - (UID: 00000000-00007192) "HQJQFTK.exe" called "FindResourceA" with parameter "3585" - (UID: 00000000-00002800) "HQJQFTK.exe" called "FindResourceA" with parameter "102" - (UID: 00000000-00002800) "OUQBA.exe" called "FindResourceA" with parameter "3585" - (UID: 00000000-00006980) "OUQBA.exe" called "FindResourceA" with parameter "102" - (UID: 00000000-00006980) "YAU.exe" called "FindResourceA" with parameter "3585" - (UID: 00000000-00001116) "YAU.exe" called "FindResourceA" with parameter "102" - (UID: 00000000-00001116) "QWNAL.exe" called "FindResourceA" with parameter "3585" - (UID: 00000000-00007988)27:T660,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00002948) "NTKA.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00005916) "SHLSGCM.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00007192) "HQJQFTK.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00002800) "OUQBA.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00006980) "YAU.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00001116) "QWNAL.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00007988) "VFFNFTJ.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00007844) "TTCMDR.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00003504) "RSFO.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00007752) "JOYJ.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00002532) "RCP.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00001536) "HNHWPQB.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4405432'}" (UID: 00000000-00007076)28:Tccd,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")29:T7cb,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")2a:T844,Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00001536.00000000.269334.02C80000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002392.00000000.270848.02A30000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002532.00000000.269175.03340000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "CallWindowProcA" (Indicator: "CallWindowProc"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002800.00000000.268071.03500000.00000004.mdmp")2b:T7e6,Found PE header "MZ" - Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002864.00000000.270005.055D0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00002948.00000000.267596.04990000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003504.00000000.268868.051A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004352.00000000.270995.04F50000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00004700.00000000.270530.05710000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005352.00000000.270192.057A0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005596.00000000.270690.05510000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00005916.00000000.267760.05200000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006928.00000000.269829.05520000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00006980.00000000.268234.04E40000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007076.00000000.269492.052F0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007192.00000000.267916.05480000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007420.00000000.269654.04CC0000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007752.00000000.269022.05350000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007844.00000000.268702.04850000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00007988.00000000.268550.05710000.00000004.mdmp")2c:Taf6,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCSERVER32") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCSERVER32") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCHANDLER32") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCHANDLER32") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCHANDLER") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCHANDLER") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\INPROCSERVER32") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\LOCALSERVER32") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\LOCALSERVER32") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\LOCALSERVER") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\LOCALSERVER") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\ELEVATION") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\ELEVATION")2d:Tb6b,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-3169600323 [PID: 2948] "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-3169610240 [PID: 2948] "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-3169761757 [PID: 2948] "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-3169769827 [PID: 2948] "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-3169886912 [PID: 2948] "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-3169896068 [PID: 2948] "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-3170576598 [PID: 2948] "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queried SystemProcessInformation at 00000000-00002948-00000C15-3170584673 [PID: 2948] "cmd.exe" queried SystemProcessInformation at 00000000-00003124-00000C15-3171439008 [PID: 3124] "cmd.exe" queried SystemProcessInformation at 00000000-00003124-00000C15-3171447631 [PID: 3124] "cmd.exe" queried SystemProcessInformation at 00000000-00003124-00000C15-3171628885 [PID: 3124] "cmd.exe" queried SystemProcessInformation at 00000000-00003124-00000C15-3171637108 [PID: 3124] "NTKA.exe" queried SystemProcessInformation at 00000000-00005916-00000C15-3172081399 [PID: 5916] "NTKA.exe" queried SystemProcessInformation at 00000000-00005916-00000C15-3172089380 [PID: 5916] "NTKA.exe" queried SystemProcessInformation at 00000000-00005916-00000C15-3172198763 [PID: 5916] "NTKA.exe" queried SystemProcessInformation at 00000000-00005916-00000C15-3172207528 [PID: 5916] "NTKA.exe" queried SystemProcessInformation at 00000000-00005916-00000C15-3172355783 [PID: 5916] "NTKA.exe" queried SystemProcessInformation at 00000000-00005916-00000C15-3172364482 [PID: 5916] "NTKA.exe" queried SystemProcessInformation at 00000000-00005916-00000C15-3173091236 [PID: 5916] "NTKA.exe" queried SystemProcessInformation at 00000000-00005916-00000C15-3173099326 [PID: 5916] "cmd.exe" queried SystemProcessInformation at 00000000-00003216-00000C15-3173884896 [PID: 3216] "cmd.exe" queried SystemProcessInformation at 00000000-00003216-00000C15-3173893165 [PID: 3216] "cmd.exe" queried SystemProcessInformation at 00000000-00003216-00000C15-3174041640 [PID: 3216] "cmd.exe" queried SystemProcessInformation at 00000000-00003216-00000C15-3174049708 [PID: 3216] "SHLSGCM.exe" queried SystemProcessInformation at 00000000-00007192-00000C15-3174515338 [PID: 7192]2e:T4c7,Process "WerFault.exe" [UID: 00000000-00005200] Process "WerFault.exe" [UID: 00000000-00005052] Process "WerFault.exe" [UID: 00000000-00006092] Process "WerFault.exe" [UID: 00000000-00006760] Process "WerFault.exe" [UID: 00000000-00007760] Process "WerFault.exe" [UID: 00000000-00007756] Process "WerFault.exe" [UID: 00000000-00002516] Process "WerFault.exe" [UID: 00000000-00004764] Process "WerFault.exe" [UID: 00000000-00000408] Process "WerFault.exe" [UID: 00000000-00000376] Process "WerFault.exe" [UID: 00000000-00004036] Process "WerFault.exe" [UID: 00000000-00004608] Process "WerFault.exe" [UID: 00000000-00007584] Process "WerFault.exe" [UID: 00000000-00001076] Process "WerFault.exe" [UID: 00000000-00001344] Process "WerFault.exe" [UID: 00000000-00006352] Process "WerFault.exe" [UID: 00000000-00006616] Process "WerFault.exe" [UID: 00000000-00005716] Process "WerFault.exe" [UID: 00000000-00005644] Process "WerFault.exe" [UID: 00000000-00002972] Process "WerFault.exe" [UID: 00000000-00005088] Process "WerFault.exe" [UID: 00000000-00004644] Process "WerFault.exe" [UID: 00000000-00002284] Process "WerFault.exe" [UID: 00000000-00002548] Process "WerFault.exe" [UID: 00000000-00003600]2f:T1274,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002948-1177-419-0040203B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002948-1177-419-0040203B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005916-2491-419-0040203B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005916-2491-419-0040203B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007192-3604-419-0040203B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007192-3604-419-0040203B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-40-0041362B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-40-0041362B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-123-00422CB0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-123-00422CB0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-130-0041AA86 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-130-0041AA86 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-131-0041DF79 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-131-0041DF79 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-191-0041CF8C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-191-0041CF8C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-192-0041EB1E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-192-0041EB1E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-195-0041EAD7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-195-0041EAD7 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-201-0041D371 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-201-0041D371 Assembly shows XOR instruction xor cl byte ptr [ebp-02h] in Stream UID: 00000000-00002800-4663-208-0041B4D4 Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 00000000-00002800-4663-208-0041B4D4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-247-00422990 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-247-00422990 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-249-00422AA0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-263-004224C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-263-004224C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-324-0040BE98 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-324-0040BE98 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-325-0040BD49 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-325-0040BD49 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-396-0040519C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-396-0040519C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-410-00401CED Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-410-00401CED Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-415-00402322 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-415-00402322 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-416-0040203B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-416-0040203B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-433-00402748 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-433-00402748 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-451-004046A5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-451-004046A5 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-549-0040AFFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-549-0040AFFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002800-4663-550-0040B135 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002800-4663-550-0040B13530:T1ca8,Found XOR loop in file "RBFFNT.exe" at offset 146427; code bytes = 8030 Found XOR loop in file "VFFNFTJ.exe" at offset 6994; code bytes = 30d0 Found XOR loop in file "VFFNFTJ.exe" at offset 29868; code bytes = 30d0 Found XOR loop in file "VFFNFTJ.exe" at offset 115477; code bytes = 30d0 Found XOR loop in file "VFFNFTJ.exe" at offset 138188; code bytes = 30d0 Found XOR loop in file "VFFNFTJ.exe" at offset 40723; code bytes = 8030 Found XOR loop in file "VFFNFTJ.exe" at offset 135899; code bytes = 8030 Found XOR loop in file "VFFNFTJ.exe" at offset 135906; code bytes = 8030 Found XOR loop in file "LYVXACA.exe" at offset 62283; code bytes = 33c1 Found XOR loop in file "LYVXACA.exe" at offset 62882; code bytes = 33c1 Found XOR loop in file "LYVXACA.exe" at offset 129860; code bytes = 33c1 Found XOR loop in file "PQLZSP.exe" at offset 53821; code bytes = 30d0 Found XOR loop in file "RSFO.exe" at offset 140559; code bytes = 30d0 Found XOR loop in file "RSFO.exe" at offset 127105; code bytes = 8030 Found XOR loop in file "RSFO.exe" at offset 128451; code bytes = 8030 Found XOR loop in file "OUQBA.exe" at offset 11979; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 18855; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 18863; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 18895; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 21828; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 21873; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 21937; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 22119; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 22631; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 22777; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 25992; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 32862; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 32873; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 36811; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 54520; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 73916; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 73920; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 97862; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 98574; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 98641; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 103275; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 107243; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 107256; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 109830; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 110170; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 110334; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 124453; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 124495; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 124505; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 124539; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 124625; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 124669; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 124693; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 130276; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 131550; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 132141; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 132337; code bytes = 33c1 Found XOR loop in file "OUQBA.exe" at offset 132792; code bytes = 33c1 Found XOR loop in file "YAU.exe" at offset 49208; code bytes = 30d0 Found XOR loop in file "YAU.exe" at offset 83229; code bytes = 30d0 Found XOR loop in file "YAU.exe" at offset 55299; code bytes = 8030 Found XOR loop in file "YAU.exe" at offset 126895; code bytes = 8030 Found XOR loop in file "YAU.exe" at offset 128241; code bytes = 8030 Found XOR loop in file "YAU.exe" at offset 132610; code bytes = 8030 Found XOR loop in file "YAU.exe" at offset 134242; code bytes = 8030 Found XOR loop in file "YAU.exe" at offset 134275; code bytes = 8030 Found XOR loop in file "YAU.exe" at offset 134381; code bytes = 8030 Found XOR loop in file "SHLSGCM.exe" at offset 107049; code bytes = 30d0 Found XOR loop in file "NTKA.exe" at offset 88491; code bytes = 30d0 Found XOR loop in file "NTKA.exe" at offset 95937; code bytes = 33c1 Found XOR loop in file "JOYJ.exe" at offset 65672; code bytes = 30d0 Found XOR loop in file "TTCMDR.exe" at offset 6796; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 21243; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 29120; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 36553; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 54012; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 54032; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 64459; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 71133; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 71268; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 71424; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 89997; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 90303; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 93275; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 116891; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 126668; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 127037; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 127216; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 127391; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 128014; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 128383; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 128562; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 128737; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 133511; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 141517; code bytes = 8030 Found XOR loop in file "TTCMDR.exe" at offset 141530; code bytes = 8030 Found XOR loop in file "HNHWPQB.exe" at offset 84801; code bytes = 30d0 Found XOR loop in file "HNHWPQB.exe" at offset 146952; code bytes = 33c1 Found XOR loop in file "HNHWPQB.exe" at offset 123570; code bytes = 8030 Found XOR loop in file "HNHWPQB.exe" at offset 125200; code bytes = 8030 Found XOR loop in file "HNHWPQB.exe" at offset 130135; code bytes = 8030 Found XOR loop in file "HNHWPQB.exe" at offset 131405; code bytes = 8030 Found XOR loop in file "HNHWPQB.exe" at offset 131996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 108524; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 78830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103167; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 130415; code bytes = 803031:Ta41,Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") file/memory contains long string with (Indicator: "GetCursorPos"; File: "HQJQFTK.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "RBFFNT.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "VFFNFTJ.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "LYVXACA.exe") file/memory contains long string with (Indicator: "GetCommandLine"; File: "PQLZSP.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "RSFO.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "MVJOU.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "OUQBA.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "YAU.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "OMZLOC.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "RCP.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "SUL.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "JOYJ.exe") file/memory contains long string with (Indicator: "GetCursorPos"; File: "TTCMDR.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp")32:T404,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")33:Tcc7,Found system information discovery API: "GetEnvironmentStringsW" in file "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" Found system information discovery API: "GetEnvironmentStrings" in file "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" Found system information discovery API: "GetMonitorInfoA" in file "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" Found system information discovery API: "GetUserObjectInformationA" in file "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" Found system information discovery API: "GetMonitorInfoA" in "00000000-00000940.00000000.270374.056C0000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00000940.00000000.270374.056C0000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00000940.00000000.270374.056C0000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00000940.00000000.270374.056C0000.00000004.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00001116.00000000.268389.05000000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00001116.00000000.268389.05000000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00001116.00000000.268389.05000000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001116.00000000.268389.05000000.00000004.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00001536.00000000.269334.04D80000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00001536.00000000.269334.04D80000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00001536.00000000.269334.04D80000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001536.00000000.269334.04D80000.00000004.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00002392.00000000.270848.04C60000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00002392.00000000.270848.04C60000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00002392.00000000.270848.04C60000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002392.00000000.270848.04C60000.00000004.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00002532.00000000.269175.056B0000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00002532.00000000.269175.056B0000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00002532.00000000.269175.056B0000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00002532.00000000.269175.056B0000.00000004.mdmp" Found system information discovery API: "GetMonitorInfoA" in "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp"34:T94c,Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")35:Tb64,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") file/memory contains long string with (Indicator: "sendmessage"; File: "HQJQFTK.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "VFFNFTJ.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "LYVXACA.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "PQLZSP.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "RSFO.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "MVJOU.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "OUQBA.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "YAU.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "OMZLOC.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "RCP.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "SUL.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "JOYJ.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "TTCMDR.exe") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00001536.00000000.269334.02C80000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002392.00000000.270848.02A30000.00000004.mdmp")36:T6c0,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "GetTickCount" with parameters (UID: 00000000-00002948) "NTKA.exe" called "GetTickCount" with parameters (UID: 00000000-00005916) "SHLSGCM.exe" called "GetTickCount" with parameters (UID: 00000000-00007192) "HQJQFTK.exe" called "GetTickCount" with parameters (UID: 00000000-00002800) "OUQBA.exe" called "GetTickCount" with parameters (UID: 00000000-00006980) "YAU.exe" called "GetTickCount" with parameters (UID: 00000000-00001116) "QWNAL.exe" called "GetTickCount" with parameters (UID: 00000000-00007988) "VFFNFTJ.exe" called "GetTickCount" with parameters (UID: 00000000-00007844) "TTCMDR.exe" called "GetTickCount" with parameters (UID: 00000000-00003504) "RSFO.exe" called "GetTickCount" with parameters (UID: 00000000-00007752) "JOYJ.exe" called "GetTickCount" with parameters (UID: 00000000-00002532) "RCP.exe" called "GetTickCount" with parameters (UID: 00000000-00001536) "HNHWPQB.exe" called "GetTickCount" with parameters (UID: 00000000-00007076) "SUL.exe" called "GetTickCount" with parameters (UID: 00000000-00007420) "MVJOU.exe" called "GetTickCount" with parameters (UID: 00000000-00006928) "QEQ.exe" called "GetTickCount" with parameters (UID: 00000000-00002864) "LYVXACA.exe" called "GetTickCount" with parameters (UID: 00000000-00005352) "OMZLOC.exe" called "GetTickCount" with parameters (UID: 00000000-00000940) "PQLZSP.exe" called "GetTickCount" with parameters (UID: 00000000-00004700) "RBFFNT.exe" called "GetTickCount" with parameters (UID: 00000000-00005596) "NVE.exe" called "GetTickCount" with parameters (UID: 00000000-00002392) "FLX.exe" called "GetTickCount" with parameters (UID: 00000000-00004352)37:T530,Observed import api PathFindFileName (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757) Observed import api PathFindFileName (Source: HQJQFTK.exe) Observed import api PathFindFileName (Source: RBFFNT.exe) Observed import api PathFindFileName (Source: VFFNFTJ.exe) Observed import api PathFindFileName (Source: LYVXACA.exe) Observed import api PathFindFileName (Source: FLX.exe) Observed import api PathFindFileName (Source: PQLZSP.exe) Observed import api PathFindFileName (Source: RSFO.exe) Observed import api PathFindFileName (Source: MVJOU.exe) Observed import api PathFindFileName (Source: OUQBA.exe) Observed import api PathFindFileName (Source: YAU.exe) Observed import api PathFindFileName (Source: OMZLOC.exe) Observed import api PathFindFileName (Source: SHLSGCM.exe) Observed import api PathFindFileName (Source: QEQ.exe) Observed import api PathFindFileName (Source: NTKA.exe) Observed import api PathFindFileName (Source: NVE.exe) Observed import api PathFindFileName (Source: RCP.exe) Observed import api PathFindFileName (Source: SUL.exe) Observed import api PathFindFileName (Source: JOYJ.exe) Observed import api PathFindFileName (Source: TTCMDR.exe) Observed import api PathFindFileName (Source: QWNAL.exe) Observed import api PathFindFileName (Source: HNHWPQB.exe)38:T2c7f,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000008773187d877300000000d0a98d74000086749011877440347e0288777c0208357d02e0dc5300feffffff88df5300506a35773d1e0138feffffffa0dd5300eaa9317740347e020000000008357d02a11400000a000b00b29787735c7687736876877308357d02481a7e0214000000000000000000000040347e02c8dd5300cc2d367708357d020000000014357d0200000000f800807300000000cc0d24385ce83477684033776002000019000000110000001000000050b97c0200de53008d9ab87318b87c02f4497d020000000020de530024b57c02f4497d0238de530000008073feffffff0400000020afb87300000000000000000300000028de5300 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078a2530038cf3277cc377c02e4a253000100000080377c02cc377c0280377c02040000000400000000e0ef7400100000e4a253000100000080377c02cd9732779c973277b94e6f4fb50fe67480377c02000032770000000014409c740000000080eeec740100000000000000f8e2ef74000000000400000080a9b8734840ee74f8e2ef74e8a2530080e88075381c7d0280e88075e4a253000000000080e8807500000000e8ffffffd02560739ca75300c81815770026607318000000c0a753007ca3530003010000f0b653005119157700000000000000000000000000000000ffffffff000000000000000000000000566c80026c6c8002 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078a2530038cf3277cc377c02e4a253000100000080377c02cc377c0280377c02040000000400000000e0ef7400100000e4a253000100000080377c02cd9732779c973277b94e6f4fb50fe67480377c02000032770000000014409c740000000080eeec740100000000000000f8e2ef74000000000400000080a9b8734840ee74f8e2ef74e8a2530080e88075381c7d0280e88075e4a253000000000080e8807500000000e8ffffffd02560739ca75300c81815770026607318000000c0a753007ca3530003010000f0b653005119157700000000000000000000000000000000ffffffff0000000000000000000000003e82800256828002 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078a2530038cf3277cc377c02e4a253000100000080377c02cc377c0280377c02040000000400000000e0ef7400100000e4a253000100000080377c02cd9732779c973277b94e6f4fb50fe67480377c02000032770000000014409c740000000080eeec740100000000000000f8e2ef74000000000400000080a9b8734840ee74f8e2ef74e8a2530080e88075381c7d0280e88075e4a253000000000080e8807500000000e8ffffffd02560739ca75300c81815770026607318000000c0a753007ca3530003010000f0b653005119157700000000000000000000000000000000ffffffff0000000000000000000000000e82800222828002 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078a2530038cf3277cc377c02e4a253000100000080377c02cc377c0280377c02040000000400000000e0ef7400100000e4a253000100000080377c02cd9732779c973277b94e6f4fb50fe67480377c02000032770000000014409c740000000080eeec740100000000000000f8e2ef74000000000400000080a9b8734840ee74f8e2ef74e8a2530080e88075381c7d0280e88075e4a253000000000080e8807500000000e8ffffffd02560739ca75300c81815770026607318000000c0a753007ca3530003010000f0b653005119157700000000000000000000000000000000ffffffff00000000000000000000000046ac80025eac8002 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078a2530038cf3277cc377c02e4a253000100000080377c02cc377c0280377c02040000000400000000e0ef7400100000e4a253000100000080377c02cd9732779c973277b94e6f4fb50fe67480377c02000032770000000014409c740000000080eeec740100000000000000f8e2ef74000000000400000080a9b8734840ee74f8e2ef74e8a2530080e88075381c7d0280e88075e4a253000000000080e8807500000000e8ffffffd02560739ca75300c81815770026607318000000c0a753007ca3530003010000f0b653005119157700000000000000000000000000000000ffffffff00000000000000000000000066ab80027cab8002 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078a2530038cf3277cc377c02e4a253000100000080377c02cc377c0280377c02040000000400000000e0ef7400100000e4a253000100000080377c02cd9732779c973277b94e6f4fb50fe67480377c02000032770000000014409c740000000080eeec740100000000000000f8e2ef74000000000400000080a9b8734840ee74f8e2ef74e8a2530080e88075381c7d0280e88075e4a253000000000080e8807500000000e8ffffffd02560739ca75300c81815770026607318000000c0a753007ca3530003010000f0b653005119157700000000000000000000000000000000ffffffff000000000000000000000000e6b38002feb38002 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000078a2530038cf3277cc377c02e4a253000100000080377c02cc377c0280377c02040000000400000000e0ef7400100000e4a253000100000080377c02cd9732779c973277b94e6f4fb50fe67480377c02000032770000000014409c740000000080eeec740100000000000000f8e2ef74000000000400000080a9b8734840ee74f8e2ef74e8a2530080e88075381c7d0280e88075e4a253000000000080e8807500000000e8ffffffd02560739ca75300c81815770026607318000000c0a753007ca3530003010000f0b653005119157700000000000000000000000000000000ffffffff0000000000000000000000002eb0800246b08002 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000007c020200000002000000e0f2507464e48002e0f2507464e48002b0b75300fbf2507400007c020000000010f47d02d0b75300ea288275ff28827510f47d02020000002cb853002938827510f47d02a077747502000000000000009037827583388275e0338275ccb753008c7774752cb85300304a8d750000000010b85300e74b837544e48002f24b83751c3ee0432cb8530064f7e47440e48002a0f7827543004c005300490044005c007b00460033003200340045003400460039002d0038003400390036002d0034003000420032002d0041003100460046002d003900360031003700430031004300390041004600460045007d005c0049006e007300 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002948) "cmd.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003124) "cmd.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003124) "cmd.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003124) "NTKA.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005916) "NTKA.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005916)39:T1940,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000e0f65300d81a7d02803c7e02a07b3f77a07b3f7700000000a8747d02060000000000000000209a73001000000600000000000000c4209a7302000000d04e9973bc209a730050010000000000ffffffff0000000056004300520055004e00540049004d0045003100340030002e0064006c006c000000000000000000 (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002948) "NTKA.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000030f0bb002818160380221703a07b3f77a07b3f7700000000286f1603060000000000000000209a73001000000600000000000000c4209a7302000000d04e9973bc209a730050010000000000ffffffff0000000056004300520055004e00540049004d0045003100340030002e0064006c006c000000000000000000 (UID: 00000000-00005916) "NTKA.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005916) "SHLSGCM.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000020f3ef00101708036830090364a50703a07b3f770000000078750803060000000000000000209a73001000000600000000000000c4209a7302000000d04e9973bc209a730050010000000000ffffffff0000000056004300520055004e00540049004d0045003100340030002e0064006c006c000000000000000000 (UID: 00000000-00007192) "SHLSGCM.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007192) "HQJQFTK.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000040f72f019021510348245203a07b3f77a07b3f770000000070725103060000000000000000209a73001000000600000000000000c4209a7302000000d04e9973bc209a730050010000000000ffffffff0000000056004300520055004e00540049004d0045003100340030002e0064006c006c000000000000000000 (UID: 00000000-00002800) "HQJQFTK.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002800) "OUQBA.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000040f48f003012c102e820c202a07b3f77a07b3f77000000003071c102060000000000000000209a73001000000600000000000000c4209a7302000000d04e9973bc209a730050010000000000ffffffff0000000056004300520055004e00540049004d0045003100340030002e0064006c006c000000000000000000 (UID: 00000000-00006980) "OUQBA.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006980) "YAU.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000030f4cf00b819df02c823e002a07b3f77a07b3f77000000004875df02060000000000000000209a73001000000600000000000000c4209a7302000000d04e9973bc209a730050010000000000ffffffff0000000056004300520055004e00540049004d0045003100340030002e0064006c006c000000000000000000 (UID: 00000000-00001116) "YAU.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001116) "QWNAL.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000a8f1350138206d0320446e03cc0d6d03a07b3f7700000000487e6d03060000000000000000209a73001000000600000000000000c4209a7302000000d04e9973bc209a730050010000000000ffffffff0000000056004300520055004e00540049004d0045003100340030002e0064006c006c000000000000000000 (UID: 00000000-00007988) "QWNAL.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007988) "VFFNFTJ.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000038f71900980b5902b8325a02ac255902a07b3f770000000058745902060000000000000000209a73001000000600000000000000c4209a7302000000d04e9973bc209a730050010000000000ffffffff0000000056004300520055004e00540049004d0045003100340030002e0064006c006c000000000000000000 (UID: 00000000-00007844) "VFFNFTJ.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007844) "TTCMDR.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000060f69300d00dca020027cb02a425ca02a07b3f77000000001071ca02060000000000000000209a73001000000600000000000000c4209a7302000000d04e9973bc209a730050010000000000ffffffff0000000056004300520055004e00540049004d0045003100340030002e0064006c006c000000000000000000 (UID: 00000000-00003504)3a:T46f,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "NTKA.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "SHLSGCM.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")3b:T489,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")3c:Tc72,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")3d:Tbbc,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")3e:T9ac,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "NTKA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "SHLSGCM.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "HQJQFTK.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "OUQBA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "YAU.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "QWNAL.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "VFFNFTJ.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "TTCMDR.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "RSFO.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "JOYJ.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "RCP.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "HNHWPQB.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "SUL.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "MVJOU.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "QEQ.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "LYVXACA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "OMZLOC.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "PQLZSP.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "RBFFNT.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "NVE.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "FLX.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")3f:T501,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\NTKA.EXE.BAT") "NTKA.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SHLSGCM.EXE.BAT") "SHLSGCM.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\HQJQFTK.EXE.BAT") "HQJQFTK.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUQBA.EXE.BAT") "OUQBA.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\YAU.EXE.BAT") "YAU.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\QWNAL.EXE.BAT") "QWNAL.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\VFFNFTJ.EXE.BAT") "VFFNFTJ.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\TTCMDR.EXE.BAT") "TTCMDR.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RSFO.EXE.BAT") "RSFO.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\JOYJ.EXE.BAT") "JOYJ.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RCP.EXE.BAT") "RCP.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\HNHWPQB.EXE.BAT") "HNHWPQB.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\SUL.EXE.BAT")40:T57e,file/memory contains long string(File: "HQJQFTK.exe") file/memory contains long string(File: "RBFFNT.exe") file/memory contains long string(File: "VFFNFTJ.exe") file/memory contains long string(File: "LYVXACA.exe") file/memory contains long string(File: "PQLZSP.exe") file/memory contains long string(File: "RSFO.exe") file/memory contains long string(File: "MVJOU.exe") file/memory contains long string(File: "OUQBA.exe") file/memory contains long string(File: "YAU.exe") file/memory contains long string(File: "OMZLOC.exe") file/memory contains long string(File: "RCP.exe") file/memory contains long string(File: "SUL.exe") file/memory contains long string(File: "JOYJ.exe") file/memory contains long string(File: "TTCMDR.exe") Found string "GetCommandLineA" (Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found string "GetCommandLineA" (Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found string "GetCommandLineA" (Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found string "GetCommandLineA" (Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found string "GetCommandLineA" (Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found string "GetCommandLineA" (Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")41:T7ee,Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")42:Ta93,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "CreateProcessW" with parameter ""%WINDIR%\NTKA.exe.bat"" - (UID: 00000000-00002948) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\NTKA.exe" - (UID: 00000000-00003124) "NTKA.exe" called "CreateProcessW" with parameter ""%WINDIR%\system\SHLSGCM.exe.bat"" - (UID: 00000000-00005916) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system\SHLSGCM.exe" - (UID: 00000000-00003216) "SHLSGCM.exe" called "CreateProcessW" with parameter ""%WINDIR%\system\HQJQFTK.exe.bat"" - (UID: 00000000-00007192) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system\HQJQFTK.exe" - (UID: 00000000-00007336) "HQJQFTK.exe" called "CreateProcessW" with parameter ""%WINDIR%\OUQBA.exe.bat"" - (UID: 00000000-00002800) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\OUQBA.exe" - (UID: 00000000-00007324) "OUQBA.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\YAU.exe.bat"" - (UID: 00000000-00006980) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\YAU.exe" - (UID: 00000000-00006108) "YAU.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\QWNAL.exe.bat"" - (UID: 00000000-00001116) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\QWNAL.exe" - (UID: 00000000-00006120) "QWNAL.exe" called "CreateProcessW" with parameter ""%WINDIR%\VFFNFTJ.exe.bat"" - (UID: 00000000-00007988) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\VFFNFTJ.exe" - (UID: 00000000-00007840) "VFFNFTJ.exe" called "CreateProcessW" with parameter ""%WINDIR%\TTCMDR.exe.bat"" - (UID: 00000000-00007844) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\TTCMDR.exe" - (UID: 00000000-00007528) "TTCMDR.exe" called "CreateProcessW" with parameter ""%WINDIR%\RSFO.exe.bat"" - (UID: 00000000-00003504) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\RSFO.exe" - (UID: 00000000-00000868) "RSFO.exe" called "CreateProcessW" with parameter ""%WINDIR%\system\JOYJ.exe.bat"" - (UID: 00000000-00007752) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system\JOYJ.exe" - (UID: 00000000-00006996) "JOYJ.exe" called "CreateProcessW" with parameter ""%WINDIR%\RCP.exe.bat"" - (UID: 00000000-00002532) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\RCP.exe" - (UID: 00000000-00001632) "RCP.exe" called "CreateProcessW" with parameter ""%WINDIR%\system\HNHWPQB.exe.bat"" - (UID: 00000000-00001536) "cmd.exe" called "CreateProcessW" with parameter "%WINDIR%\system\HNHWPQB.exe" - (UID: 00000000-00003628) "HNHWPQB.exe" called "CreateProcessW" with parameter ""%WINDIR%\SUL.exe.bat"" - (UID: 00000000-00007076)43:T21ba,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "LoadLibrary" with a parameter C:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757ENU.dll (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "LoadLibrary" with a parameter C:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757LOC.dll (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002948) "NTKA.exe" called "LoadLibrary" with a parameter %WINDIR%\NTKAENU.dll (UID: 00000000-00005916) "NTKA.exe" called "LoadLibrary" with a parameter %WINDIR%\NTKALOC.dll (UID: 00000000-00005916) "NTKA.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005916) "NTKA.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005916) "SHLSGCM.exe" called "LoadLibrary" with a parameter %WINDIR%\system\SHLSGCMENU.dll (UID: 00000000-00007192) "SHLSGCM.exe" called "LoadLibrary" with a parameter %WINDIR%\system\SHLSGCMLOC.dll (UID: 00000000-00007192) "SHLSGCM.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007192) "SHLSGCM.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007192) "HQJQFTK.exe" called "LoadLibrary" with a parameter %WINDIR%\system\HQJQFTKENU.dll (UID: 00000000-00002800) "HQJQFTK.exe" called "LoadLibrary" with a parameter %WINDIR%\system\HQJQFTKLOC.dll (UID: 00000000-00002800) "HQJQFTK.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002800) "HQJQFTK.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002800) "OUQBA.exe" called "LoadLibrary" with a parameter %WINDIR%\OUQBAENU.dll (UID: 00000000-00006980) "OUQBA.exe" called "LoadLibrary" with a parameter %WINDIR%\OUQBALOC.dll (UID: 00000000-00006980) "OUQBA.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006980) "OUQBA.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006980) "YAU.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\YAUENU.dll (UID: 00000000-00001116) "YAU.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\YAULOC.dll (UID: 00000000-00001116) "YAU.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001116) "YAU.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001116) "QWNAL.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\QWNALENU.dll (UID: 00000000-00007988) "QWNAL.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\QWNALLOC.dll (UID: 00000000-00007988) "QWNAL.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007988) "QWNAL.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007988) "VFFNFTJ.exe" called "LoadLibrary" with a parameter %WINDIR%\VFFNFTJENU.dll (UID: 00000000-00007844) "VFFNFTJ.exe" called "LoadLibrary" with a parameter %WINDIR%\VFFNFTJLOC.dll (UID: 00000000-00007844) "VFFNFTJ.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007844) "VFFNFTJ.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007844) "TTCMDR.exe" called "LoadLibrary" with a parameter %WINDIR%\TTCMDRENU.dll (UID: 00000000-00003504) "TTCMDR.exe" called "LoadLibrary" with a parameter %WINDIR%\TTCMDRLOC.dll (UID: 00000000-00003504) "TTCMDR.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003504) "TTCMDR.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003504) "RSFO.exe" called "LoadLibrary" with a parameter %WINDIR%\RSFOENU.dll (UID: 00000000-00007752) "RSFO.exe" called "LoadLibrary" with a parameter %WINDIR%\RSFOLOC.dll (UID: 00000000-00007752) "RSFO.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007752) "RSFO.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007752) "JOYJ.exe" called "LoadLibrary" with a parameter %WINDIR%\system\JOYJENU.dll (UID: 00000000-00002532) "JOYJ.exe" called "LoadLibrary" with a parameter %WINDIR%\system\JOYJLOC.dll (UID: 00000000-00002532) "JOYJ.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002532) "JOYJ.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002532) "RCP.exe" called "LoadLibrary" with a parameter %WINDIR%\RCPENU.dll (UID: 00000000-00001536) "RCP.exe" called "LoadLibrary" with a parameter %WINDIR%\RCPLOC.dll (UID: 00000000-00001536) "RCP.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00001536) "RCP.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001536) "HNHWPQB.exe" called "LoadLibrary" with a parameter %WINDIR%\system\HNHWPQBENU.dll (UID: 00000000-00007076) "HNHWPQB.exe" called "LoadLibrary" with a parameter %WINDIR%\system\HNHWPQBLOC.dll (UID: 00000000-00007076) "HNHWPQB.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007076) "HNHWPQB.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007076) "SUL.exe" called "LoadLibrary" with a parameter %WINDIR%\SULENU.dll (UID: 00000000-00007420) "SUL.exe" called "LoadLibrary" with a parameter %WINDIR%\SULLOC.dll (UID: 00000000-00007420) "SUL.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007420) "SUL.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007420) "MVJOU.exe" called "LoadLibrary" with a parameter %WINDIR%\system\MVJOUENU.dll (UID: 00000000-00006928) "MVJOU.exe" called "LoadLibrary" with a parameter %WINDIR%\system\MVJOULOC.dll (UID: 00000000-00006928) "MVJOU.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00006928) "MVJOU.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00006928) "QEQ.exe" called "LoadLibrary" with a parameter %WINDIR%\QEQENU.dll (UID: 00000000-00002864) "QEQ.exe" called "LoadLibrary" with a parameter %WINDIR%\QEQLOC.dll (UID: 00000000-00002864) "QEQ.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002864) "QEQ.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002864) "LYVXACA.exe" called "LoadLibrary" with a parameter %WINDIR%\LYVXACAENU.dll (UID: 00000000-00005352) "LYVXACA.exe" called "LoadLibrary" with a parameter %WINDIR%\LYVXACALOC.dll (UID: 00000000-00005352) "LYVXACA.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005352) "LYVXACA.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005352) "OMZLOC.exe" called "LoadLibrary" with a parameter %WINDIR%\OMZLOCENU.dll (UID: 00000000-00000940) "OMZLOC.exe" called "LoadLibrary" with a parameter %WINDIR%\OMZLOCLOC.dll (UID: 00000000-00000940) "OMZLOC.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000940) "OMZLOC.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000940) "PQLZSP.exe" called "LoadLibrary" with a parameter %WINDIR%\PQLZSPENU.dll (UID: 00000000-00004700) "PQLZSP.exe" called "LoadLibrary" with a parameter %WINDIR%\PQLZSPLOC.dll (UID: 00000000-00004700) "PQLZSP.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004700) "PQLZSP.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004700) "RBFFNT.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\RBFFNTENU.dll (UID: 00000000-00005596) "RBFFNT.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\RBFFNTLOC.dll (UID: 00000000-00005596) "RBFFNT.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00005596) "RBFFNT.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00005596) "NVE.exe" called "LoadLibrary" with a parameter %WINDIR%\NVEENU.dll (UID: 00000000-00002392) "NVE.exe" called "LoadLibrary" with a parameter %WINDIR%\NVELOC.dll (UID: 00000000-00002392) "NVE.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002392) "NVE.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002392) "FLX.exe" called "LoadLibrary" with a parameter %WINDIR%\system\FLXENU.dll (UID: 00000000-00004352) "FLX.exe" called "LoadLibrary" with a parameter %WINDIR%\system\FLXLOC.dll (UID: 00000000-00004352) "FLX.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004352) "FLX.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004352)44:T76c,Found GetProcAddress() and LoadLibraryA() in an import section (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757) Found GetProcAddress() and LoadLibraryA() in an import section (Source: HQJQFTK.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: RBFFNT.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: VFFNFTJ.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: LYVXACA.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: FLX.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: PQLZSP.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: RSFO.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: MVJOU.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: OUQBA.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: YAU.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: OMZLOC.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: SHLSGCM.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: QEQ.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: NTKA.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: NVE.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: RCP.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: SUL.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: JOYJ.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: TTCMDR.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: QWNAL.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: HNHWPQB.exe)45:T87b,Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "yncShellExecutek" (Indicator: "ShellExecute"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00001536.00000000.269334.02C80000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00002392.00000000.270848.02A30000.00000004.mdmp") Found reference to API "98196,5240,3190,,ShellExecuteA,Shell32.dll,"01:10:28.640",RX=0,PX=0" (Indicator: "ShellExecute"; Source: "00000000-00002392.00000000.270848.02A30000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00002532.00000000.269175.03340000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "yncShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00002800.00000000.268071.03500000.00000004.mdmp")46:T177a,Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\NTKA.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\NTKA.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\SHLSGCM.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\SHLSGCM.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\HQJQFTK.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\HQJQFTK.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\OUQBA.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\OUQBA.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system32\YAU.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system32\YAU.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system32\QWNAL.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system32\QWNAL.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\VFFNFTJ.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\VFFNFTJ.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\TTCMDR.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\TTCMDR.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\RSFO.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\RSFO.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\JOYJ.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\JOYJ.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\RCP.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\RCP.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\HNHWPQB.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\HNHWPQB.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\SUL.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\SUL.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\MVJOU.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\MVJOU.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\QEQ.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\QEQ.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\LYVXACA.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\LYVXACA.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\OMZLOC.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\OMZLOC.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\PQLZSP.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\PQLZSP.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system32\RBFFNT.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system32\RBFFNT.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\NVE.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\NVE.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\FLX.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; File: "cmd.exe") Found string "%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\FLX.exe.bat" "" (Indicator: "cmd.exe /c"; File: "cmd.exe") Found string ":\WINDOWS\system32\cmd.exe /c ""C:\windows\PQLZSP.exe.bat" "" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c ""C:\windows\PQLZSP.exe.bat" "" (Indicator: "cmd.exe /c"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c" (Indicator: "cmd.exe /c"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c" (Indicator: "cmd.exe /c"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c" (Indicator: "cmd.exe /c"; Source: "00000000-00001536.00000000.269334.02C80000.00000004.mdmp")47:Td64,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "LockResource" (Indicator: "LockResource"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp")48:T412,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")49:T7e0,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")4a:T86c,Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")4b:T16ca,"C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OMZLOC.exe" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\omzloc.exe") in Source: 00000000-00000940.00000000.270374.01201000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\OMZLOC.exe" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\omzloc.exe") in Source: 00000000-00000940.00000000.270374.01201000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00000940.00000000.270374.034A0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00000940.00000000.270374.034A0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YAU.exe" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\yau.exe") in Source: 00000000-00001116.00000000.268389.00C01000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\YAU.exe" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\yau.exe") in Source: 00000000-00001116.00000000.268389.00C01000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001116.00000000.268389.02DE0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001116.00000000.268389.02DE0000.00000004.mdmp "ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "programdata%\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001116.00000000.268389.02DE0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RCP.exe" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\rcp.exe") in Source: 00000000-00001536.00000000.269334.00801000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RCP.exe" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\rcp.exe") in Source: 00000000-00001536.00000000.269334.00801000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001536.00000000.269334.02C80000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001536.00000000.269334.02C80000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NVE.exe" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\nve.exe") in Source: 00000000-00002392.00000000.270848.00801000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NVE.exe" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\nve.exe") in Source: 00000000-00002392.00000000.270848.00801000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "??\c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JOYJ.exe" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\joyj.exe") in Source: 00000000-00002532.00000000.269175.01201000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\JOYJ.exe" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\joyj.exe") in Source: 00000000-00002532.00000000.269175.01201000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HQJQFTK.exe" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\hqjqftk.exe") in Source: 00000000-00002800.00000000.268071.01201000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HQJQFTK.exe" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\hqjqftk.exe") in Source: 00000000-00002800.00000000.268071.01201000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002800.00000000.268071.03500000.00000004.mdmp4c:T1f7d,"Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757 "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757 "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757 "Software\" in Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757 "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757 "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00000940.00000000.270374.034A0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000940.00000000.270374.034A0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000940.00000000.270374.034A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000940.00000000.270374.034A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00000940.00000000.270374.056C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00000940.00000000.270374.056C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00000940.00000000.270374.056C0000.00000004.mdmp "Software\" in Source: 00000000-00000940.00000000.270374.056C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00000940.00000000.270374.056C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001116.00000000.268389.02DE0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001116.00000000.268389.02DE0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001116.00000000.268389.02DE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001116.00000000.268389.02DE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00001116.00000000.268389.05000000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00001116.00000000.268389.05000000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00001116.00000000.268389.05000000.00000004.mdmp "Software\" in Source: 00000000-00001116.00000000.268389.05000000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00001116.00000000.268389.05000000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001536.00000000.269334.02C80000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001536.00000000.269334.02C80000.00000004.mdmp "stry\Machine\Software\C" in Source: 00000000-00001536.00000000.269334.02C80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001536.00000000.269334.02C80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00001536.00000000.269334.04D80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00001536.00000000.269334.04D80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00001536.00000000.269334.04D80000.00000004.mdmp "Software\" in Source: 00000000-00001536.00000000.269334.04D80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00001536.00000000.269334.04D80000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00002392.00000000.270848.04C60000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00002392.00000000.270848.04C60000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00002392.00000000.270848.04C60000.00000004.mdmp "Software\" in Source: 00000000-00002392.00000000.270848.04C60000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00002392.00000000.270848.04C60000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00002532.00000000.269175.056B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00002532.00000000.269175.056B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00002532.00000000.269175.056B0000.00000004.mdmp "Software\" in Source: 00000000-00002532.00000000.269175.056B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00002532.00000000.269175.056B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00002800.00000000.268071.00425000.00000002.mdmp 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00002800.00000000.268071.00425000.00000002.mdmp 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00002800.00000000.268071.00425000.00000002.mdmp 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp "Software\" in Source: 00000000-00002800.00000000.268071.00425000.00000002.mdmp 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00002800.00000000.268071.00425000.00000002.mdmp 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002800.00000000.268071.03500000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002800.00000000.268071.03500000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002800.00000000.268071.03500000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00002800.00000000.268071.03500000.00000004.mdmp4d:Tbba,Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2948:168:WilStaging_02" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2948:168:WilStaging_02" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2948:64:WilError_01" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2948:64:WilError_01" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "Local\SM0:2948:64:WilError_01" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "Local\ZonesCacheCounterMutex" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "SM0:2948:64:WilError_01" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "Local\SM0:2948:168:WilStaging_02" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "SM0:2948:168:WilStaging_02" Process 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process NTKA.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5916:168:WilStaging_02" Process NTKA.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5916:168:WilStaging_02" Process NTKA.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5916:64:WilError_01" Process NTKA.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process NTKA.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5916:64:WilError_01" Process NTKA.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process NTKA.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process NTKA.exe created mutex with name "SM0:5916:64:WilError_01" Process NTKA.exe created mutex with name "Local\SM0:5916:168:WilStaging_02" Process NTKA.exe created mutex with name "SM0:5916:168:WilStaging_02" Process NTKA.exe created mutex with name "Local\SM0:5916:64:WilError_01" Process NTKA.exe created mutex with name "Local\ZonesLockedCacheCounterMutex"4e:T720,Antivirus vendors marked dropped file "RBFFNT.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "QWNAL.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "HQJQFTK.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "SHLSGCM.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "HNHWPQB.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "MVJOU.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "YAU.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "JOYJ.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "FLX.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "LYVXACA.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "VFFNFTJ.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "PQLZSP.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "TTCMDR.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "OMZLOC.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "OUQBA.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "RSFO.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "NTKA.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "NVE.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "SUL.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "RCP.exe.bat" as clean (type is "ASCII text") Antivirus vendors marked dropped file "QEQ.exe.bat" as clean (type is "ASCII text")4f:Ta62,Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\NTKA.exe.bat" "" (UID: 00000000-00003124) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\SHLSGCM.exe.bat" "" (UID: 00000000-00003216) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\HQJQFTK.exe.bat" "" (UID: 00000000-00007336) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\OUQBA.exe.bat" "" (UID: 00000000-00007324) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system32\\YAU.exe.bat" "" (UID: 00000000-00006108) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system32\\QWNAL.exe.bat" "" (UID: 00000000-00006120) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\VFFNFTJ.exe.bat" "" (UID: 00000000-00007840) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\TTCMDR.exe.bat" "" (UID: 00000000-00007528) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\RSFO.exe.bat" "" (UID: 00000000-00000868) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\JOYJ.exe.bat" "" (UID: 00000000-00006996) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\RCP.exe.bat" "" (UID: 00000000-00001632) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\HNHWPQB.exe.bat" "" (UID: 00000000-00003628) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\SUL.exe.bat" "" (UID: 00000000-00003648) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\MVJOU.exe.bat" "" (UID: 00000000-00004704) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\QEQ.exe.bat" "" (UID: 00000000-00005764) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\LYVXACA.exe.bat" "" (UID: 00000000-00007220) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\OMZLOC.exe.bat" "" (UID: 00000000-00007308) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\PQLZSP.exe.bat" "" (UID: 00000000-00004816) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system32\\RBFFNT.exe.bat" "" (UID: 00000000-00005556) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\NVE.exe.bat" "" (UID: 00000000-00004344) Process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\FLX.exe.bat" "" (UID: 00000000-00003264)50:T11b8,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" failed to load missing module "C:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757ENU.dll" - [base:0; Status:c0000135] "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" failed to load missing module "C:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757LOC.dll" - [base:0; Status:c0000135] "NTKA.exe" failed to load missing module "%WINDIR%\NTKAENU.dll" - [base:0; Status:c0000135] "NTKA.exe" failed to load missing module "%WINDIR%\NTKALOC.dll" - [base:0; Status:c0000135] "SHLSGCM.exe" failed to load missing module "%WINDIR%\system\SHLSGCMENU.dll" - [base:0; Status:c0000135] "SHLSGCM.exe" failed to load missing module "%WINDIR%\system\SHLSGCMLOC.dll" - [base:0; Status:c0000135] "HQJQFTK.exe" failed to load missing module "%WINDIR%\system\HQJQFTKENU.dll" - [base:0; Status:c0000135] "HQJQFTK.exe" failed to load missing module "%WINDIR%\system\HQJQFTKLOC.dll" - [base:0; Status:c0000135] "OUQBA.exe" failed to load missing module "%WINDIR%\OUQBAENU.dll" - [base:0; Status:c0000135] "OUQBA.exe" failed to load missing module "%WINDIR%\OUQBALOC.dll" - [base:0; Status:c0000135] "YAU.exe" failed to load missing module "%WINDIR%\SysWOW64\YAUENU.dll" - [base:0; Status:c0000135] "YAU.exe" failed to load missing module "%WINDIR%\SysWOW64\YAULOC.dll" - [base:0; Status:c0000135] "QWNAL.exe" failed to load missing module "%WINDIR%\SysWOW64\QWNALENU.dll" - [base:0; Status:c0000135] "QWNAL.exe" failed to load missing module "%WINDIR%\SysWOW64\QWNALLOC.dll" - [base:0; Status:c0000135] "VFFNFTJ.exe" failed to load missing module "%WINDIR%\VFFNFTJENU.dll" - [base:0; Status:c0000135] "VFFNFTJ.exe" failed to load missing module "%WINDIR%\VFFNFTJLOC.dll" - [base:0; Status:c0000135] "TTCMDR.exe" failed to load missing module "%WINDIR%\TTCMDRENU.dll" - [base:0; Status:c0000135] "TTCMDR.exe" failed to load missing module "%WINDIR%\TTCMDRLOC.dll" - [base:0; Status:c0000135] "RSFO.exe" failed to load missing module "%WINDIR%\RSFOENU.dll" - [base:0; Status:c0000135] "RSFO.exe" failed to load missing module "%WINDIR%\RSFOLOC.dll" - [base:0; Status:c0000135] "JOYJ.exe" failed to load missing module "%WINDIR%\system\JOYJENU.dll" - [base:0; Status:c0000135] "JOYJ.exe" failed to load missing module "%WINDIR%\system\JOYJLOC.dll" - [base:0; Status:c0000135] "RCP.exe" failed to load missing module "%WINDIR%\RCPENU.dll" - [base:0; Status:c0000135] "RCP.exe" failed to load missing module "%WINDIR%\RCPLOC.dll" - [base:0; Status:c0000135] "HNHWPQB.exe" failed to load missing module "%WINDIR%\system\HNHWPQBENU.dll" - [base:0; Status:c0000135] "HNHWPQB.exe" failed to load missing module "%WINDIR%\system\HNHWPQBLOC.dll" - [base:0; Status:c0000135] "SUL.exe" failed to load missing module "%WINDIR%\SULENU.dll" - [base:0; Status:c0000135] "SUL.exe" failed to load missing module "%WINDIR%\SULLOC.dll" - [base:0; Status:c0000135] "MVJOU.exe" failed to load missing module "%WINDIR%\system\MVJOUENU.dll" - [base:0; Status:c0000135] "MVJOU.exe" failed to load missing module "%WINDIR%\system\MVJOULOC.dll" - [base:0; Status:c0000135] "QEQ.exe" failed to load missing module "%WINDIR%\QEQENU.dll" - [base:0; Status:c0000135] "QEQ.exe" failed to load missing module "%WINDIR%\QEQLOC.dll" - [base:0; Status:c0000135] "LYVXACA.exe" failed to load missing module "%WINDIR%\LYVXACAENU.dll" - [base:0; Status:c0000135] "LYVXACA.exe" failed to load missing module "%WINDIR%\LYVXACALOC.dll" - [base:0; Status:c0000135] "OMZLOC.exe" failed to load missing module "%WINDIR%\OMZLOCENU.dll" - [base:0; Status:c0000135] "OMZLOC.exe" failed to load missing module "%WINDIR%\OMZLOCLOC.dll" - [base:0; Status:c0000135] "PQLZSP.exe" failed to load missing module "%WINDIR%\PQLZSPENU.dll" - [base:0; Status:c0000135] "PQLZSP.exe" failed to load missing module "%WINDIR%\PQLZSPLOC.dll" - [base:0; Status:c0000135] "RBFFNT.exe" failed to load missing module "%WINDIR%\SysWOW64\RBFFNTENU.dll" - [base:0; Status:c0000135] "RBFFNT.exe" failed to load missing module "%WINDIR%\SysWOW64\RBFFNTLOC.dll" - [base:0; Status:c0000135] "NVE.exe" failed to load missing module "%WINDIR%\NVEENU.dll" - [base:0; Status:c0000135] "NVE.exe" failed to load missing module "%WINDIR%\NVELOC.dll" - [base:0; Status:c0000135] "FLX.exe" failed to load missing module "%WINDIR%\system\FLXENU.dll" - [base:0; Status:c0000135] "FLX.exe" failed to load missing module "%WINDIR%\system\FLXLOC.dll" - [base:0; Status:c0000135]51:T64e9,"\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00000940.00000000.270374.034A0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00000940.00000000.270374.034A0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000940.00000000.270374.034A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000940.00000000.270374.034A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00000940.00000000.270374.056C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00000940.00000000.270374.056C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00000940.00000000.270374.056C0000.00000004.mdmp "Software\" in Source: 00000000-00000940.00000000.270374.056C0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00000940.00000000.270374.056C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001116.00000000.268389.02DE0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001116.00000000.268389.02DE0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001116.00000000.268389.02DE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001116.00000000.268389.02DE0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00001116.00000000.268389.05000000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00001116.00000000.268389.05000000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00001116.00000000.268389.05000000.00000004.mdmp "Software\" in Source: 00000000-00001116.00000000.268389.05000000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00001116.00000000.268389.05000000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001536.00000000.269334.02C80000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001536.00000000.269334.02C80000.00000004.mdmp "stry\Machine\Software\C" in Source: 00000000-00001536.00000000.269334.02C80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001536.00000000.269334.02C80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00001536.00000000.269334.04D80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00001536.00000000.269334.04D80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00001536.00000000.269334.04D80000.00000004.mdmp "Software\" in Source: 00000000-00001536.00000000.269334.04D80000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00001536.00000000.269334.04D80000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002392.00000000.270848.02A30000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00002392.00000000.270848.04C60000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00002392.00000000.270848.04C60000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00002392.00000000.270848.04C60000.00000004.mdmp "Software\" in Source: 00000000-00002392.00000000.270848.04C60000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00002392.00000000.270848.04C60000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00002532.00000000.269175.03340000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00002532.00000000.269175.056B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00002532.00000000.269175.056B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00002532.00000000.269175.056B0000.00000004.mdmp "Software\" in Source: 00000000-00002532.00000000.269175.056B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00002532.00000000.269175.056B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00002800.00000000.268071.00425000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00002800.00000000.268071.00425000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00002800.00000000.268071.00425000.00000002.mdmp "Software\" in Source: 00000000-00002800.00000000.268071.00425000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00002800.00000000.268071.00425000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002800.00000000.268071.03500000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002800.00000000.268071.03500000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002800.00000000.268071.03500000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00002800.00000000.268071.03500000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp "Software\" in Source: 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00002864.00000000.270005.03520000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00002864.00000000.270005.03520000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002864.00000000.270005.03520000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002864.00000000.270005.03520000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00002864.00000000.270005.03520000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00002864.00000000.270005.055D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00002864.00000000.270005.055D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00002864.00000000.270005.055D0000.00000004.mdmp "Software\" in Source: 00000000-00002864.00000000.270005.055D0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00002864.00000000.270005.055D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002948.00000000.267596.027C0000.00000004.mdmp "stry\Machine\Software\CZ" in Source: 00000000-00002948.00000000.267596.027C0000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00002948.00000000.267596.027C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00002948.00000000.267596.04990000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00002948.00000000.267596.04990000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00002948.00000000.267596.04990000.00000004.mdmp "Software\" in Source: 00000000-00002948.00000000.267596.04990000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00002948.00000000.267596.04990000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00003504.00000000.268868.02C90000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003504.00000000.268868.02C90000.00000004.mdmp "\Software\Classes\AllFilesy" in Source: 00000000-00003504.00000000.268868.02C90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003504.00000000.268868.02C90000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00003504.00000000.268868.02C90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00003504.00000000.268868.051A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00003504.00000000.268868.051A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00003504.00000000.268868.051A0000.00000004.mdmp "Software\" in Source: 00000000-00003504.00000000.268868.051A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00003504.00000000.268868.051A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00004352.00000000.270995.04F50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00004352.00000000.270995.04F50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00004352.00000000.270995.04F50000.00000004.mdmp "Software\" in Source: 00000000-00004352.00000000.270995.04F50000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00004352.00000000.270995.04F50000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00004700.00000000.270530.03210000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004700.00000000.270530.03210000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004700.00000000.270530.03210000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00004700.00000000.270530.03210000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00004700.00000000.270530.05710000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00004700.00000000.270530.05710000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00004700.00000000.270530.05710000.00000004.mdmp "Software\" in Source: 00000000-00004700.00000000.270530.05710000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00004700.00000000.270530.05710000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005352.00000000.270192.03240000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005352.00000000.270192.03240000.00000004.mdmp "stry\Machine\Software\C" in Source: 00000000-00005352.00000000.270192.03240000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005352.00000000.270192.03240000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005352.00000000.270192.057A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00005352.00000000.270192.057A0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00005352.00000000.270192.057A0000.00000004.mdmp "Software\" in Source: 00000000-00005352.00000000.270192.057A0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00005352.00000000.270192.057A0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005596.00000000.270690.03190000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005596.00000000.270690.03190000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005596.00000000.270690.03190000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005596.00000000.270690.03190000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005596.00000000.270690.05510000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00005596.00000000.270690.05510000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00005596.00000000.270690.05510000.00000004.mdmp "Software\" in Source: 00000000-00005596.00000000.270690.05510000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00005596.00000000.270690.05510000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00005916.00000000.267760.03150000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005916.00000000.267760.03150000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005916.00000000.267760.03150000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00005916.00000000.267760.05200000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00005916.00000000.267760.05200000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00005916.00000000.267760.05200000.00000004.mdmp "Software\" in Source: 00000000-00005916.00000000.267760.05200000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00005916.00000000.267760.05200000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006928.00000000.269829.03480000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A07" in Source: 00000000-00006928.00000000.269829.03480000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006928.00000000.269829.03480000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006928.00000000.269829.03480000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00006928.00000000.269829.05520000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00006928.00000000.269829.05520000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00006928.00000000.269829.05520000.00000004.mdmp "Software\" in Source: 00000000-00006928.00000000.269829.05520000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00006928.00000000.269829.05520000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00006980.00000000.268234.02C00000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00006980.00000000.268234.02C00000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006980.00000000.268234.02C00000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00006980.00000000.268234.02C00000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006980.00000000.268234.02C00000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00006980.00000000.268234.04E40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00006980.00000000.268234.04E40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00006980.00000000.268234.04E40000.00000004.mdmp "Software\" in Source: 00000000-00006980.00000000.268234.04E40000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00006980.00000000.268234.04E40000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007076.00000000.269492.02F90000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007076.00000000.269492.02F90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007076.00000000.269492.02F90000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00007076.00000000.269492.02F90000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007076.00000000.269492.052F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00007076.00000000.269492.052F0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00007076.00000000.269492.052F0000.00000004.mdmp "Software\" in Source: 00000000-00007076.00000000.269492.052F0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00007076.00000000.269492.052F0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007192.00000000.267916.03070000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007192.00000000.267916.03070000.00000004.mdmp "Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00007192.00000000.267916.03070000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007192.00000000.267916.05480000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00007192.00000000.267916.05480000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00007192.00000000.267916.05480000.00000004.mdmp "Software\" in Source: 00000000-00007192.00000000.267916.05480000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00007192.00000000.267916.05480000.00000004.mdmp "hine\Software\Classes\Directory\Clsid" in Source: 00000000-00007420.00000000.269654.025C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007420.00000000.269654.025C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007420.00000000.269654.025C0000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00007420.00000000.269654.025C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007420.00000000.269654.04CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00007420.00000000.269654.04CC0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00007420.00000000.269654.04CC0000.00000004.mdmp "Software\" in Source: 00000000-00007420.00000000.269654.04CC0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00007420.00000000.269654.04CC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00007752.00000000.269022.03110000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007752.00000000.269022.03110000.00000004.mdmp "stry\Machine\Software\C" in Source: 00000000-00007752.00000000.269022.03110000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007752.00000000.269022.03110000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00007752.00000000.269022.03110000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007752.00000000.269022.05350000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00007752.00000000.269022.05350000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00007752.00000000.269022.05350000.00000004.mdmp "Software\" in Source: 00000000-00007752.00000000.269022.05350000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00007752.00000000.269022.05350000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007844.00000000.268702.02580000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007844.00000000.268702.02580000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00007844.00000000.268702.02580000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007844.00000000.268702.04850000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00007844.00000000.268702.04850000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00007844.00000000.268702.04850000.00000004.mdmp "Software\" in Source: 00000000-00007844.00000000.268702.04850000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00007844.00000000.268702.04850000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007988.00000000.268550.00425000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00007988.00000000.268550.00425000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00007988.00000000.268550.00425000.00000002.mdmp "Software\" in Source: 00000000-00007988.00000000.268550.00425000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00007988.00000000.268550.00425000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007988.00000000.268550.036C0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007988.00000000.268550.036C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007988.00000000.268550.036C0000.00000004.mdmp "stry\Machine\Software\Classes\Applications\%1.exe" in Source: 00000000-00007988.00000000.268550.036C0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007988.00000000.268550.05710000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00007988.00000000.268550.05710000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00007988.00000000.268550.05710000.00000004.mdmp "Software\" in Source: 00000000-00007988.00000000.268550.05710000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: 00000000-00007988.00000000.268550.05710000.00000004.mdmp52:T9293,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "IMM32.DLL" at base 74200000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "COMCTL32.DLL" at base 73800000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "KERNEL32.DLL" at base 77210000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "NTDLL.DLL" at base 772e0000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "SHELL32.DLL" at base 75d70000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "RPCRT4.DLL" at base 75160000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "USER32.DLL" at base 74860000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "MSISO.DLL" at base 73110000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "SSPICLI.DLL" at base 73c00000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "cmd.exe" loaded module "NTDLL.DLL" at base 772e0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73b60000 "NTKA.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "NTKA.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "NTKA.exe" loaded module "IMM32.DLL" at base 74200000 "NTKA.exe" loaded module "COMCTL32.DLL" at base 73800000 "NTKA.exe" loaded module "KERNEL32.DLL" at base 77210000 "NTKA.exe" loaded module "OLEAUT32.DLL" at base 75220000 "NTKA.exe" loaded module "RPCRT4.DLL" at base 75160000 "NTKA.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "NTKA.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "NTKA.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "NTKA.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "NTKA.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "NTKA.exe" loaded module "NTDLL.DLL" at base 772e0000 "NTKA.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "NTKA.exe" loaded module "SHELL32.DLL" at base 75d70000 "NTKA.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "NTKA.exe" loaded module "USER32.DLL" at base 74860000 "NTKA.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "NTKA.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "NTKA.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "NTKA.exe" loaded module "MSISO.DLL" at base 73110000 "NTKA.exe" loaded module "SSPICLI.DLL" at base 73c00000 "NTKA.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "NTKA.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "SHLSGCM.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "SHLSGCM.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "SHLSGCM.exe" loaded module "IMM32.DLL" at base 74200000 "SHLSGCM.exe" loaded module "COMCTL32.DLL" at base 73800000 "SHLSGCM.exe" loaded module "KERNEL32.DLL" at base 77210000 "SHLSGCM.exe" loaded module "OLEAUT32.DLL" at base 75220000 "SHLSGCM.exe" loaded module "RPCRT4.DLL" at base 75160000 "SHLSGCM.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "SHLSGCM.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "SHLSGCM.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "SHLSGCM.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "SHLSGCM.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "SHLSGCM.exe" loaded module "NTDLL.DLL" at base 772e0000 "SHLSGCM.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "SHLSGCM.exe" loaded module "SHELL32.DLL" at base 75d70000 "SHLSGCM.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "SHLSGCM.exe" loaded module "USER32.DLL" at base 74860000 "SHLSGCM.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "SHLSGCM.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "SHLSGCM.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "SHLSGCM.exe" loaded module "MSISO.DLL" at base 73110000 "SHLSGCM.exe" loaded module "SSPICLI.DLL" at base 73c00000 "SHLSGCM.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "SHLSGCM.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "HQJQFTK.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "HQJQFTK.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "HQJQFTK.exe" loaded module "IMM32.DLL" at base 74200000 "HQJQFTK.exe" loaded module "COMCTL32.DLL" at base 73800000 "HQJQFTK.exe" loaded module "KERNEL32.DLL" at base 77210000 "HQJQFTK.exe" loaded module "OLEAUT32.DLL" at base 75220000 "HQJQFTK.exe" loaded module "RPCRT4.DLL" at base 75160000 "HQJQFTK.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "HQJQFTK.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "HQJQFTK.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "HQJQFTK.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "HQJQFTK.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "HQJQFTK.exe" loaded module "NTDLL.DLL" at base 772e0000 "HQJQFTK.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "HQJQFTK.exe" loaded module "SHELL32.DLL" at base 75d70000 "HQJQFTK.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "HQJQFTK.exe" loaded module "USER32.DLL" at base 74860000 "HQJQFTK.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "HQJQFTK.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "HQJQFTK.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "HQJQFTK.exe" loaded module "MSISO.DLL" at base 73110000 "HQJQFTK.exe" loaded module "SSPICLI.DLL" at base 73c00000 "HQJQFTK.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "HQJQFTK.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "OUQBA.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "OUQBA.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "OUQBA.exe" loaded module "IMM32.DLL" at base 74200000 "OUQBA.exe" loaded module "COMCTL32.DLL" at base 73800000 "OUQBA.exe" loaded module "KERNEL32.DLL" at base 77210000 "OUQBA.exe" loaded module "OLEAUT32.DLL" at base 75220000 "OUQBA.exe" loaded module "RPCRT4.DLL" at base 2e00000 "OUQBA.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "OUQBA.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "OUQBA.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "OUQBA.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "OUQBA.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "OUQBA.exe" loaded module "NTDLL.DLL" at base 772e0000 "OUQBA.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "OUQBA.exe" loaded module "SHELL32.DLL" at base 75d70000 "OUQBA.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "OUQBA.exe" loaded module "USER32.DLL" at base 74860000 "OUQBA.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "OUQBA.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "OUQBA.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "OUQBA.exe" loaded module "MSISO.DLL" at base 73110000 "OUQBA.exe" loaded module "SSPICLI.DLL" at base 73c00000 "OUQBA.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "OUQBA.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "YAU.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "YAU.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "YAU.exe" loaded module "IMM32.DLL" at base 74200000 "YAU.exe" loaded module "COMCTL32.DLL" at base 73800000 "YAU.exe" loaded module "KERNEL32.DLL" at base 77210000 "YAU.exe" loaded module "OLEAUT32.DLL" at base 75220000 "YAU.exe" loaded module "RPCRT4.DLL" at base 75160000 "YAU.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "YAU.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "YAU.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "YAU.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "YAU.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "YAU.exe" loaded module "NTDLL.DLL" at base 772e0000 "YAU.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "YAU.exe" loaded module "SHELL32.DLL" at base 75d70000 "YAU.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "YAU.exe" loaded module "USER32.DLL" at base 74860000 "YAU.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "YAU.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "YAU.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "YAU.exe" loaded module "MSISO.DLL" at base 73110000 "YAU.exe" loaded module "SSPICLI.DLL" at base 73c00000 "YAU.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "YAU.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "QWNAL.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "QWNAL.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "QWNAL.exe" loaded module "IMM32.DLL" at base 74200000 "QWNAL.exe" loaded module "COMCTL32.DLL" at base 73800000 "QWNAL.exe" loaded module "KERNEL32.DLL" at base 77210000 "QWNAL.exe" loaded module "OLEAUT32.DLL" at base 75220000 "QWNAL.exe" loaded module "RPCRT4.DLL" at base 75160000 "QWNAL.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "QWNAL.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "QWNAL.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "QWNAL.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "QWNAL.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "QWNAL.exe" loaded module "NTDLL.DLL" at base 772e0000 "QWNAL.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "QWNAL.exe" loaded module "SHELL32.DLL" at base 75d70000 "QWNAL.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "QWNAL.exe" loaded module "USER32.DLL" at base 74860000 "QWNAL.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "QWNAL.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "QWNAL.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "QWNAL.exe" loaded module "MSISO.DLL" at base 73110000 "QWNAL.exe" loaded module "SSPICLI.DLL" at base 73c00000 "QWNAL.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "QWNAL.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "VFFNFTJ.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "VFFNFTJ.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "VFFNFTJ.exe" loaded module "IMM32.DLL" at base 74200000 "VFFNFTJ.exe" loaded module "COMCTL32.DLL" at base 73800000 "VFFNFTJ.exe" loaded module "KERNEL32.DLL" at base 77210000 "VFFNFTJ.exe" loaded module "OLEAUT32.DLL" at base 75220000 "VFFNFTJ.exe" loaded module "RPCRT4.DLL" at base 75160000 "VFFNFTJ.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "VFFNFTJ.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "VFFNFTJ.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "VFFNFTJ.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "VFFNFTJ.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "VFFNFTJ.exe" loaded module "NTDLL.DLL" at base 772e0000 "VFFNFTJ.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "VFFNFTJ.exe" loaded module "SHELL32.DLL" at base 75d70000 "VFFNFTJ.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "VFFNFTJ.exe" loaded module "USER32.DLL" at base 74860000 "VFFNFTJ.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "VFFNFTJ.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "VFFNFTJ.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "VFFNFTJ.exe" loaded module "MSISO.DLL" at base 73110000 "VFFNFTJ.exe" loaded module "SSPICLI.DLL" at base 73c00000 "VFFNFTJ.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "VFFNFTJ.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "TTCMDR.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "TTCMDR.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "TTCMDR.exe" loaded module "IMM32.DLL" at base 74200000 "TTCMDR.exe" loaded module "COMCTL32.DLL" at base 73800000 "TTCMDR.exe" loaded module "KERNEL32.DLL" at base 77210000 "TTCMDR.exe" loaded module "OLEAUT32.DLL" at base 75220000 "TTCMDR.exe" loaded module "RPCRT4.DLL" at base 75160000 "TTCMDR.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "TTCMDR.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "TTCMDR.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "TTCMDR.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "TTCMDR.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "TTCMDR.exe" loaded module "NTDLL.DLL" at base 772e0000 "TTCMDR.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "TTCMDR.exe" loaded module "SHELL32.DLL" at base 75d70000 "TTCMDR.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "TTCMDR.exe" loaded module "USER32.DLL" at base 74860000 "TTCMDR.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "TTCMDR.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "TTCMDR.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "TTCMDR.exe" loaded module "MSISO.DLL" at base 73110000 "TTCMDR.exe" loaded module "SSPICLI.DLL" at base 73c00000 "TTCMDR.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "TTCMDR.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "RSFO.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "RSFO.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "RSFO.exe" loaded module "IMM32.DLL" at base 74200000 "RSFO.exe" loaded module "COMCTL32.DLL" at base 73800000 "RSFO.exe" loaded module "KERNEL32.DLL" at base 77210000 "RSFO.exe" loaded module "OLEAUT32.DLL" at base 75220000 "RSFO.exe" loaded module "RPCRT4.DLL" at base 75160000 "RSFO.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "RSFO.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "RSFO.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "RSFO.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "RSFO.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "RSFO.exe" loaded module "NTDLL.DLL" at base 772e0000 "RSFO.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "RSFO.exe" loaded module "SHELL32.DLL" at base 75d70000 "RSFO.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "RSFO.exe" loaded module "USER32.DLL" at base 74860000 "RSFO.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "RSFO.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "RSFO.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "RSFO.exe" loaded module "MSISO.DLL" at base 73110000 "RSFO.exe" loaded module "SSPICLI.DLL" at base 73c00000 "RSFO.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "RSFO.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "JOYJ.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "JOYJ.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "JOYJ.exe" loaded module "IMM32.DLL" at base 74200000 "JOYJ.exe" loaded module "COMCTL32.DLL" at base 73800000 "JOYJ.exe" loaded module "KERNEL32.DLL" at base 77210000 "JOYJ.exe" loaded module "OLEAUT32.DLL" at base 75220000 "JOYJ.exe" loaded module "RPCRT4.DLL" at base 75160000 "JOYJ.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "JOYJ.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "JOYJ.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "JOYJ.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "JOYJ.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "JOYJ.exe" loaded module "NTDLL.DLL" at base 772e0000 "JOYJ.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "JOYJ.exe" loaded module "SHELL32.DLL" at base 75d70000 "JOYJ.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "JOYJ.exe" loaded module "USER32.DLL" at base 74860000 "JOYJ.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "JOYJ.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "JOYJ.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "JOYJ.exe" loaded module "MSISO.DLL" at base 73110000 "JOYJ.exe" loaded module "SSPICLI.DLL" at base 73c00000 "JOYJ.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "JOYJ.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "RCP.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "RCP.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "RCP.exe" loaded module "IMM32.DLL" at base 74200000 "RCP.exe" loaded module "COMCTL32.DLL" at base 73800000 "RCP.exe" loaded module "KERNEL32.DLL" at base 77210000 "RCP.exe" loaded module "OLEAUT32.DLL" at base 75220000 "RCP.exe" loaded module "RPCRT4.DLL" at base 75160000 "RCP.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "RCP.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "RCP.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "RCP.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "RCP.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "RCP.exe" loaded module "NTDLL.DLL" at base 772e0000 "RCP.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "RCP.exe" loaded module "SHELL32.DLL" at base 75d70000 "RCP.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "RCP.exe" loaded module "USER32.DLL" at base 74860000 "RCP.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "RCP.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "RCP.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "RCP.exe" loaded module "MSISO.DLL" at base 73110000 "RCP.exe" loaded module "SSPICLI.DLL" at base 73c00000 "RCP.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "RCP.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "HNHWPQB.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "HNHWPQB.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "HNHWPQB.exe" loaded module "IMM32.DLL" at base 74200000 "HNHWPQB.exe" loaded module "COMCTL32.DLL" at base 73800000 "HNHWPQB.exe" loaded module "KERNEL32.DLL" at base 77210000 "HNHWPQB.exe" loaded module "OLEAUT32.DLL" at base 75220000 "HNHWPQB.exe" loaded module "RPCRT4.DLL" at base 75160000 "HNHWPQB.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "HNHWPQB.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "HNHWPQB.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "HNHWPQB.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "HNHWPQB.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "HNHWPQB.exe" loaded module "NTDLL.DLL" at base 772e0000 "HNHWPQB.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "HNHWPQB.exe" loaded module "SHELL32.DLL" at base 75d70000 "HNHWPQB.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "HNHWPQB.exe" loaded module "USER32.DLL" at base 74860000 "HNHWPQB.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "HNHWPQB.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "HNHWPQB.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "HNHWPQB.exe" loaded module "MSISO.DLL" at base 73110000 "HNHWPQB.exe" loaded module "SSPICLI.DLL" at base 73c00000 "HNHWPQB.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "HNHWPQB.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "SUL.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "SUL.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "SUL.exe" loaded module "IMM32.DLL" at base 74200000 "SUL.exe" loaded module "COMCTL32.DLL" at base 73800000 "SUL.exe" loaded module "KERNEL32.DLL" at base 77210000 "SUL.exe" loaded module "OLEAUT32.DLL" at base 75220000 "SUL.exe" loaded module "RPCRT4.DLL" at base 75160000 "SUL.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "SUL.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "SUL.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "SUL.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "SUL.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "SUL.exe" loaded module "NTDLL.DLL" at base 772e0000 "SUL.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "SUL.exe" loaded module "SHELL32.DLL" at base 75d70000 "SUL.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "SUL.exe" loaded module "USER32.DLL" at base 74860000 "SUL.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "SUL.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "SUL.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "SUL.exe" loaded module "MSISO.DLL" at base 73110000 "SUL.exe" loaded module "SSPICLI.DLL" at base 73c00000 "SUL.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "SUL.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "MVJOU.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "MVJOU.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "MVJOU.exe" loaded module "IMM32.DLL" at base 74200000 "MVJOU.exe" loaded module "COMCTL32.DLL" at base 73800000 "MVJOU.exe" loaded module "KERNEL32.DLL" at base 77210000 "MVJOU.exe" loaded module "OLEAUT32.DLL" at base 75220000 "MVJOU.exe" loaded module "RPCRT4.DLL" at base 75160000 "MVJOU.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "MVJOU.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "MVJOU.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "MVJOU.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "MVJOU.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "MVJOU.exe" loaded module "NTDLL.DLL" at base 772e0000 "MVJOU.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "MVJOU.exe" loaded module "SHELL32.DLL" at base 75d70000 "MVJOU.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "MVJOU.exe" loaded module "USER32.DLL" at base 74860000 "MVJOU.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "MVJOU.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "MVJOU.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "MVJOU.exe" loaded module "MSISO.DLL" at base 73110000 "MVJOU.exe" loaded module "SSPICLI.DLL" at base 73c00000 "MVJOU.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "MVJOU.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "QEQ.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "QEQ.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "QEQ.exe" loaded module "IMM32.DLL" at base 74200000 "QEQ.exe" loaded module "COMCTL32.DLL" at base 73800000 "QEQ.exe" loaded module "KERNEL32.DLL" at base 77210000 "QEQ.exe" loaded module "OLEAUT32.DLL" at base 75220000 "QEQ.exe" loaded module "RPCRT4.DLL" at base 75160000 "QEQ.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "QEQ.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "QEQ.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "QEQ.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "QEQ.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "QEQ.exe" loaded module "NTDLL.DLL" at base 772e0000 "QEQ.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "QEQ.exe" loaded module "SHELL32.DLL" at base 75d70000 "QEQ.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "QEQ.exe" loaded module "USER32.DLL" at base 74860000 "QEQ.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "QEQ.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "QEQ.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "QEQ.exe" loaded module "MSISO.DLL" at base 73110000 "QEQ.exe" loaded module "SSPICLI.DLL" at base 73c00000 "QEQ.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "QEQ.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "LYVXACA.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "LYVXACA.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "LYVXACA.exe" loaded module "IMM32.DLL" at base 74200000 "LYVXACA.exe" loaded module "COMCTL32.DLL" at base 73800000 "LYVXACA.exe" loaded module "KERNEL32.DLL" at base 77210000 "LYVXACA.exe" loaded module "OLEAUT32.DLL" at base 75220000 "LYVXACA.exe" loaded module "RPCRT4.DLL" at base 75160000 "LYVXACA.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "LYVXACA.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "LYVXACA.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "LYVXACA.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "LYVXACA.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "LYVXACA.exe" loaded module "NTDLL.DLL" at base 772e0000 "LYVXACA.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "LYVXACA.exe" loaded module "SHELL32.DLL" at base 75d70000 "LYVXACA.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "LYVXACA.exe" loaded module "USER32.DLL" at base 74860000 "LYVXACA.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "LYVXACA.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "LYVXACA.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "LYVXACA.exe" loaded module "MSISO.DLL" at base 73110000 "LYVXACA.exe" loaded module "SSPICLI.DLL" at base 73c00000 "LYVXACA.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "LYVXACA.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "OMZLOC.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "OMZLOC.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "OMZLOC.exe" loaded module "IMM32.DLL" at base 74200000 "OMZLOC.exe" loaded module "COMCTL32.DLL" at base 73800000 "OMZLOC.exe" loaded module "KERNEL32.DLL" at base 77210000 "OMZLOC.exe" loaded module "OLEAUT32.DLL" at base 75220000 "OMZLOC.exe" loaded module "RPCRT4.DLL" at base 75160000 "OMZLOC.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "OMZLOC.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "OMZLOC.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "OMZLOC.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "OMZLOC.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "OMZLOC.exe" loaded module "NTDLL.DLL" at base 772e0000 "OMZLOC.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "OMZLOC.exe" loaded module "SHELL32.DLL" at base 75d70000 "OMZLOC.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "OMZLOC.exe" loaded module "USER32.DLL" at base 74860000 "OMZLOC.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "OMZLOC.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "OMZLOC.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "OMZLOC.exe" loaded module "MSISO.DLL" at base 73110000 "OMZLOC.exe" loaded module "SSPICLI.DLL" at base 73c00000 "OMZLOC.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "OMZLOC.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "PQLZSP.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "PQLZSP.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "PQLZSP.exe" loaded module "IMM32.DLL" at base 74200000 "PQLZSP.exe" loaded module "COMCTL32.DLL" at base 73800000 "PQLZSP.exe" loaded module "KERNEL32.DLL" at base 77210000 "PQLZSP.exe" loaded module "OLEAUT32.DLL" at base 75220000 "PQLZSP.exe" loaded module "RPCRT4.DLL" at base 75160000 "PQLZSP.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "PQLZSP.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "PQLZSP.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "PQLZSP.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "PQLZSP.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "PQLZSP.exe" loaded module "NTDLL.DLL" at base 772e0000 "PQLZSP.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "PQLZSP.exe" loaded module "SHELL32.DLL" at base 75d70000 "PQLZSP.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "PQLZSP.exe" loaded module "USER32.DLL" at base 74860000 "PQLZSP.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "PQLZSP.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "PQLZSP.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "PQLZSP.exe" loaded module "MSISO.DLL" at base 73110000 "PQLZSP.exe" loaded module "SSPICLI.DLL" at base 73c00000 "PQLZSP.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "PQLZSP.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "RBFFNT.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "RBFFNT.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "RBFFNT.exe" loaded module "IMM32.DLL" at base 74200000 "RBFFNT.exe" loaded module "COMCTL32.DLL" at base 73800000 "RBFFNT.exe" loaded module "KERNEL32.DLL" at base 77210000 "RBFFNT.exe" loaded module "OLEAUT32.DLL" at base 75220000 "RBFFNT.exe" loaded module "RPCRT4.DLL" at base 75160000 "RBFFNT.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "RBFFNT.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "RBFFNT.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "RBFFNT.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "RBFFNT.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "RBFFNT.exe" loaded module "NTDLL.DLL" at base 772e0000 "RBFFNT.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "RBFFNT.exe" loaded module "SHELL32.DLL" at base 75d70000 "RBFFNT.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "RBFFNT.exe" loaded module "USER32.DLL" at base 74860000 "RBFFNT.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "RBFFNT.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "RBFFNT.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "RBFFNT.exe" loaded module "MSISO.DLL" at base 73110000 "RBFFNT.exe" loaded module "SSPICLI.DLL" at base 73c00000 "RBFFNT.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "RBFFNT.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "NVE.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "NVE.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "NVE.exe" loaded module "IMM32.DLL" at base 74200000 "NVE.exe" loaded module "COMCTL32.DLL" at base 73800000 "NVE.exe" loaded module "KERNEL32.DLL" at base 77210000 "NVE.exe" loaded module "OLEAUT32.DLL" at base 75220000 "NVE.exe" loaded module "RPCRT4.DLL" at base 75160000 "NVE.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "NVE.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "NVE.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "NVE.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75340000 "NVE.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 742c0000 "NVE.exe" loaded module "NTDLL.DLL" at base 772e0000 "NVE.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 735f0000 "NVE.exe" loaded module "SHELL32.DLL" at base 75d70000 "NVE.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 77210000 "NVE.exe" loaded module "USER32.DLL" at base 74860000 "NVE.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 73170000 "NVE.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d70000 "NVE.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73420000 "NVE.exe" loaded module "MSISO.DLL" at base 73110000 "NVE.exe" loaded module "SSPICLI.DLL" at base 73c00000 "NVE.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 74d50000 "NVE.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 756f0000 "FLX.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73910000 "FLX.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73890000 "FLX.exe" loaded module "IMM32.DLL" at base 74200000 "FLX.exe" loaded module "COMCTL32.DLL" at base 73800000 "FLX.exe" loaded module "KERNEL32.DLL" at base 77210000 "FLX.exe" loaded module "OLEAUT32.DLL" at base 75220000 "FLX.exe" loaded module "RPCRT4.DLL" at base 75160000 "FLX.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74860000 "FLX.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74860000 "FLX.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74420000 "FLX.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7534000053:T603,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74B70000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 02660000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73AA0000 "cmd.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74B70000 "NTKA.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74B70000 "NTKA.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73AA0000 "SHLSGCM.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74B70000 "SHLSGCM.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73AA0000 "HQJQFTK.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74B70000 "HQJQFTK.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73AA0000 "OUQBA.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74B70000 "OUQBA.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73AA0000 "YAU.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74B70000 "YAU.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73AA0000 "QWNAL.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74B70000 "QWNAL.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73AA0000 "VFFNFTJ.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 74B70000 "VFFNFTJ.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73AA000054:T48d,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75160000 "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 026E0000 "cmd.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75160000 "NTKA.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75160000 "NTKA.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 03350000 "SHLSGCM.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75160000 "HQJQFTK.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75160000 "OUQBA.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75160000 "OUQBA.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 02E00000 "YAU.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75160000 "QWNAL.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75160000 "VFFNFTJ.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75160000 "TTCMDR.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75160000 "RSFO.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 75160000 "JOYJ.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 7516000055:T11a4,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" was detected as "MFC" and name: "Library" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" was detected as "Microsoft Visual C++" and name: "Compiler" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" was detected as "Microsoft Linker" and name: "Linker" "HQJQFTK.exe" was detected as "MFC" and name: "Library" "HQJQFTK.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "HQJQFTK.exe" was detected as "Microsoft Linker" and name: "Linker" "RBFFNT.exe" was detected as "MFC" and name: "Library" "RBFFNT.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "RBFFNT.exe" was detected as "Microsoft Linker" and name: "Linker" "VFFNFTJ.exe" was detected as "MFC" and name: "Library" "VFFNFTJ.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "VFFNFTJ.exe" was detected as "Microsoft Linker" and name: "Linker" "LYVXACA.exe" was detected as "MFC" and name: "Library" "LYVXACA.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "LYVXACA.exe" was detected as "Microsoft Linker" and name: "Linker" "FLX.exe" was detected as "MFC" and name: "Library" "FLX.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "FLX.exe" was detected as "Microsoft Linker" and name: "Linker" "PQLZSP.exe" was detected as "MFC" and name: "Library" "PQLZSP.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "PQLZSP.exe" was detected as "Microsoft Linker" and name: "Linker" "RSFO.exe" was detected as "MFC" and name: "Library" "RSFO.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "RSFO.exe" was detected as "Microsoft Linker" and name: "Linker" "MVJOU.exe" was detected as "MFC" and name: "Library" "MVJOU.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "MVJOU.exe" was detected as "Microsoft Linker" and name: "Linker" "OUQBA.exe" was detected as "MFC" and name: "Library" "OUQBA.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "OUQBA.exe" was detected as "Microsoft Linker" and name: "Linker" "YAU.exe" was detected as "MFC" and name: "Library" "YAU.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "YAU.exe" was detected as "Microsoft Linker" and name: "Linker" "OMZLOC.exe" was detected as "MFC" and name: "Library" "OMZLOC.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "OMZLOC.exe" was detected as "Microsoft Linker" and name: "Linker" "SHLSGCM.exe" was detected as "MFC" and name: "Library" "SHLSGCM.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "SHLSGCM.exe" was detected as "Microsoft Linker" and name: "Linker" "QEQ.exe" was detected as "MFC" and name: "Library" "QEQ.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "QEQ.exe" was detected as "Microsoft Linker" and name: "Linker" "NTKA.exe" was detected as "MFC" and name: "Library" "NTKA.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "NTKA.exe" was detected as "Microsoft Linker" and name: "Linker" "NVE.exe" was detected as "MFC" and name: "Library" "NVE.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "NVE.exe" was detected as "Microsoft Linker" and name: "Linker" "RCP.exe" was detected as "MFC" and name: "Library" "RCP.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "RCP.exe" was detected as "Microsoft Linker" and name: "Linker" "SUL.exe" was detected as "MFC" and name: "Library" "SUL.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "SUL.exe" was detected as "Microsoft Linker" and name: "Linker" "JOYJ.exe" was detected as "MFC" and name: "Library" "JOYJ.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "JOYJ.exe" was detected as "Microsoft Linker" and name: "Linker" "TTCMDR.exe" was detected as "MFC" and name: "Library" "TTCMDR.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "TTCMDR.exe" was detected as "Microsoft Linker" and name: "Linker" "QWNAL.exe" was detected as "MFC" and name: "Library" "QWNAL.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "QWNAL.exe" was detected as "Microsoft Linker" and name: "Linker" "HNHWPQB.exe" was detected as "MFC" and name: "Library" "HNHWPQB.exe" was detected as "Microsoft Visual C++" and name: "Compiler" "HNHWPQB.exe" was detected as "Microsoft Linker" and name: "Linker"56:T6bd,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")57:T4c2,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" has an executable section named ".text" "HQJQFTK.exe" has an executable section named ".text" "RBFFNT.exe" has an executable section named ".text" "VFFNFTJ.exe" has an executable section named ".text" "LYVXACA.exe" has an executable section named ".text" "FLX.exe" has an executable section named ".text" "PQLZSP.exe" has an executable section named ".text" "RSFO.exe" has an executable section named ".text" "MVJOU.exe" has an executable section named ".text" "OUQBA.exe" has an executable section named ".text" "YAU.exe" has an executable section named ".text" "OMZLOC.exe" has an executable section named ".text" "SHLSGCM.exe" has an executable section named ".text" "QEQ.exe" has an executable section named ".text" "NTKA.exe" has an executable section named ".text" "NVE.exe" has an executable section named ".text" "RCP.exe" has an executable section named ".text" "SUL.exe" has an executable section named ".text" "JOYJ.exe" has an executable section named ".text" "TTCMDR.exe" has an executable section named ".text" "QWNAL.exe" has an executable section named ".text" "HNHWPQB.exe" has an executable section named ".text"58:T571,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" has an writable section named ".text" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" has an writable section named ".data" "HQJQFTK.exe" has an writable section named ".text" "HQJQFTK.exe" has an writable section named ".data" "RBFFNT.exe" has an writable section named ".text" "RBFFNT.exe" has an writable section named ".data" "VFFNFTJ.exe" has an writable section named ".text" "VFFNFTJ.exe" has an writable section named ".data" "LYVXACA.exe" has an writable section named ".text" "LYVXACA.exe" has an writable section named ".data" "FLX.exe" has an writable section named ".text" "FLX.exe" has an writable section named ".data" "PQLZSP.exe" has an writable section named ".text" "PQLZSP.exe" has an writable section named ".data" "RSFO.exe" has an writable section named ".text" "RSFO.exe" has an writable section named ".data" "MVJOU.exe" has an writable section named ".text" "MVJOU.exe" has an writable section named ".data" "OUQBA.exe" has an writable section named ".text" "OUQBA.exe" has an writable section named ".data" "YAU.exe" has an writable section named ".text" "YAU.exe" has an writable section named ".data" "OMZLOC.exe" has an writable section named ".text" "OMZLOC.exe" has an writable section named ".data" "SHLSGCM.exe" has an writable section named ".text"59:T4ed1,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" file has an entrypoint instructions - "pushal ,mov ecx, 0x2319c,mov bl, byte ptr [ecx + 0x400fff],rol bl, 0x61,sub bl, 0x9c,mov byte ptr [ecx + 0x400fff], bl,loop 0x4241a1,popal ,push 0x40f21d,ret ,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "HQJQFTK.exe" file has an entrypoint instructions - "pushal ,mov ecx, 0x2319c,mov al, byte ptr [ecx + 0x400fff],xor al, 0x14,add al, 0x3e,mov byte ptr [ecx + 0x400fff], al,loop 0x4241a1,popal ,push 0x40f21d,ret ,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "RBFFNT.exe" file has an entrypoint instructions - "pushal ,mov edx, 0,mov ah, byte ptr [edx + 0x401000],rol ah, 0xf8,xor ah, 0x6c,xor ah, 0xc3,rol ah, 0xa6,mov byte ptr [edx + 0x401000], ah,add edx, 1,cmp edx, 0x2319b,jne 0x4241a1,popal ,jmp 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "VFFNFTJ.exe" file has an entrypoint instructions - "pushal ,mov ecx, 0,mov bh, byte ptr [ecx + 0x401000],rol bh, 0xe5,rol bh, 0x41,rol bh, 0x51,mov byte ptr [ecx + 0x401000], bh,inc ecx,cmp ecx, 0x2319b,jne 0x4241a1,popal ,jmp 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "LYVXACA.exe" file has an entrypoint instructions - "pushal ,mov ecx, 0x2319c,mov dl, byte ptr [ecx + 0x400fff],rol dl, 0x42,rol dl, 0xe6,mov byte ptr [ecx + 0x400fff], dl,loop 0x4241a1,popal ,call 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "FLX.exe" file has an entrypoint instructions - "pushal ,mov ebx, 0,mov cl, byte ptr [ebx + 0x401000],xor cl, 0xaa,sub cl, 0x40,add cl, 0xae,rol cl, 0x82,mov byte ptr [ebx + 0x401000], cl,inc ebx,cmp ebx, 0x2319b,jne 0x4241a1,popal ,call 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "PQLZSP.exe" file has an entrypoint instructions - "pushal ,mov ecx, 0x2319c,mov dh, byte ptr [ecx + 0x400fff],rol dh, 0xf4,sub dh, 0xba,mov byte ptr [ecx + 0x400fff], dh,loop 0x4241a1,popal ,call 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "RSFO.exe" file has an entrypoint instructions - "pushal ,mov esi, 0,mov dh, byte ptr [esi + 0x401000],rol dh, 0x29,xor dh, 0xb9,sub dh, 0x2c,mov byte ptr [esi + 0x401000], dh,inc esi,cmp esi, 0x2319b,jne 0x4241a1,popal ,call 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "MVJOU.exe" file has an entrypoint instructions - "pushal ,mov eax, 0,mov dh, byte ptr [eax + 0x401000],add dh, 0x3a,rol dh, 0x82,mov byte ptr [eax + 0x401000], dh,add eax, 1,cmp eax, 0x2319b,jne 0x4241a1,popal ,call 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "OUQBA.exe" file has an entrypoint instructions - "pushal ,mov ebx, 0,mov al, byte ptr [ebx + 0x401000],ror al, 0x87,mov byte ptr [ebx + 0x401000], al,inc ebx,cmp ebx, 0x2319b,jne 0x4241a1,popal ,jmp 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "YAU.exe" file has an entrypoint instructions - "pushal ,mov ecx, 0x2319c,mov dh, byte ptr [ecx + 0x400fff],xor dh, 0x12,add dh, 0x55,sub dh, 0x74,mov byte ptr [ecx + 0x400fff], dh,loop 0x4241a1,popal ,jmp 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "OMZLOC.exe" file has an entrypoint instructions - "pushal ,mov ecx, 0,mov al, byte ptr [ecx + 0x401000],rol al, 0x46,xor al, 0x98,add al, 0xd7,sub al, 0xca,mov byte ptr [ecx + 0x401000], al,add ecx, 1,cmp ecx, 0x2319b,jne 0x4241a1,popal ,push 0x40f21d,ret ,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "SHLSGCM.exe" file has an entrypoint instructions - "pushal ,mov edx, 0,mov bl, byte ptr [edx + 0x401000],add bl, 0xbd,ror bl, 0xcc,ror bl, 0xed,ror bl, 0x26,mov byte ptr [edx + 0x401000], bl,add edx, 1,cmp edx, 0x2319b,jne 0x4241a1,popal ,jmp 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "QEQ.exe" file has an entrypoint instructions - "pushal ,mov eax, 0,mov dh, byte ptr [eax + 0x401000],add dh, 0x34,xor dh, 0xef,xor dh, 0xc2,xor dh, 0xbb,mov byte ptr [eax + 0x401000], dh,add eax, 1,cmp eax, 0x2319b,jne 0x4241a1,popal ,push 0x40f21d,ret ,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "NTKA.exe" file has an entrypoint instructions - "pushal ,mov ecx, 0x2319c,mov ah, byte ptr [ecx + 0x400fff],xor ah, 0x62,ror ah, 0x6b,mov byte ptr [ecx + 0x400fff], ah,loop 0x4241a1,popal ,call 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "NVE.exe" file has an entrypoint instructions - "pushal ,mov ecx, 0x2319c,mov bl, byte ptr [ecx + 0x400fff],ror bl, 0xa5,xor bl, 0x8d,xor bl, 0xbb,mov byte ptr [ecx + 0x400fff], bl,loop 0x4241a1,popal ,call 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "RCP.exe" file has an entrypoint instructions - "pushal ,mov ecx, 0x2319c,mov bl, byte ptr [ecx + 0x400fff],ror bl, 0x84,sub bl, 0xfc,rol bl, 0x1c,sub bl, 0xdd,mov byte ptr [ecx + 0x400fff], bl,loop 0x4241a1,popal ,call 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "SUL.exe" file has an entrypoint instructions - "pushal ,mov ecx, 0x2319c,mov al, byte ptr [ecx + 0x400fff],add al, 0x36,mov byte ptr [ecx + 0x400fff], al,loop 0x4241a1,popal ,jmp 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "JOYJ.exe" file has an entrypoint instructions - "pushal ,mov esi, 0,mov ch, byte ptr [esi + 0x401000],xor ch, 0xd6,sub ch, 0xdb,mov byte ptr [esi + 0x401000], ch,inc esi,cmp esi, 0x2319b,jne 0x4241a1,popal ,push 0x40f21d,ret ,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "TTCMDR.exe" file has an entrypoint instructions - "pushal ,mov eax, 0,mov dl, byte ptr [eax + 0x401000],ror dl, 0x1c,mov byte ptr [eax + 0x401000], dl,add eax, 1,cmp eax, 0x2319b,jne 0x4241a1,popal ,push 0x40f21d,ret ,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "QWNAL.exe" file has an entrypoint instructions - "pushal ,mov ebx, 0,mov ch, byte ptr [ebx + 0x401000],xor ch, 0x51,mov byte ptr [ebx + 0x401000], ch,add ebx, 1,cmp ebx, 0x2319b,jne 0x4241a1,popal ,call 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "HNHWPQB.exe" file has an entrypoint instructions - "pushal ,mov edi, 0,mov cl, byte ptr [edi + 0x401000],ror cl, 0x88,ror cl, 0xae,mov byte ptr [edi + 0x401000], cl,add edi, 1,cmp edi, 0x2319b,jne 0x4241a1,popal ,call 0x40f21d,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"5a:T2906,Observed system executable string:"%WINDIR%\NTKA.exe" [Source: 00000000-00002948-00000C2D-2424569026] Observed system executable string:"%WINDIR%\SysWOW64\cmd.exe" [Source: 00000000-00002948-00000BC0-3171089724] Observed system executable string:""%WINDIR%\NTKA.exe.bat"" [Source: 00000000-00002948-00000C47-3602180304] Observed system executable string:"%WINDIR%\NTKA.exe.bat" [Source: 00000000-00002948-00000C76-3653296620] Observed system executable string:"%WINDIR%\system\SHLSGCM.exe" [Source: 00000000-00005916-00000C2D-2512192512] Observed system executable string:""%WINDIR%\system\SHLSGCM.exe.bat"" [Source: 00000000-00005916-00000C47-3370626524] Observed system executable string:"%WINDIR%\system\SHLSGCM.exe.bat" [Source: 00000000-00005916-00000C76-3406571116] Observed system executable string:"%WINDIR%\System\SHLSGCM.exe" [Source: 00000000-00003216-00000BC0-3174188261] Observed system executable string:"%WINDIR%\system\HQJQFTK.exe" [Source: 00000000-00007192-00000C2D-2444879872] Observed system executable string:""%WINDIR%\system\HQJQFTK.exe.bat"" [Source: 00000000-00007192-00000C47-3436194780] Observed system executable string:"%WINDIR%\system\HQJQFTK.exe.bat" [Source: 00000000-00007192-00000C76-3490432650] Observed system executable string:"%WINDIR%\System\HQJQFTK.exe" [Source: 00000000-00007336-00000BC0-3176610934] Observed system executable string:"%WINDIR%\OUQBA.exe" [Source: 00000000-00002800-00000C2D-2490467714] Observed system executable string:""%WINDIR%\OUQBA.exe.bat"" [Source: 00000000-00002800-00000C47-3581098118] Observed system executable string:"%WINDIR%\OUQBA.exe.bat" [Source: 00000000-00002800-00000C76-3633350150] Observed system executable string:"%WINDIR%\system32\YAU.exe" [Source: 00000000-00006980-00000C2D-2428770918] Observed system executable string:""%WINDIR%\system32\YAU.exe.bat"" [Source: 00000000-00006980-00000C47-3410022156] Observed system executable string:"%WINDIR%\system32\YAU.exe.bat" [Source: 00000000-00006980-00000C76-3463209996] Observed system executable string:"%WINDIR%\SysWOW64\YAU.exe" [Source: 00000000-00006108-00000BC0-3181568380] Observed system executable string:"%WINDIR%\system32\QWNAL.exe" [Source: 00000000-00001116-00000C2D-2358821138] Observed system executable string:""%WINDIR%\system32\QWNAL.exe.bat"" [Source: 00000000-00001116-00000C47-3472214108] Observed system executable string:"%WINDIR%\system32\QWNAL.exe.bat" [Source: 00000000-00001116-00000C76-3523516000] Observed system executable string:"%WINDIR%\SysWOW64\QWNAL.exe" [Source: 00000000-00006120-00000BC0-3184083988] Observed system executable string:"%WINDIR%\VFFNFTJ.exe" [Source: 00000000-00007988-00000C2D-2499170220] Observed system executable string:""%WINDIR%\VFFNFTJ.exe.bat"" [Source: 00000000-00007988-00000C47-3437970382] Observed system executable string:"%WINDIR%\VFFNFTJ.exe.bat" [Source: 00000000-00007988-00000C76-3488969026] Observed system executable string:"%WINDIR%\TTCMDR.exe" [Source: 00000000-00007844-00000C2D-2514997406] Observed system executable string:""%WINDIR%\TTCMDR.exe.bat"" [Source: 00000000-00007844-00000C47-3547035216] Observed system executable string:"%WINDIR%\TTCMDR.exe.bat" [Source: 00000000-00007844-00000C76-3582551658] Observed system executable string:"%WINDIR%\RSFO.exe" [Source: 00000000-00003504-00000C2D-2479087408] Observed system executable string:""%WINDIR%\RSFO.exe.bat"" [Source: 00000000-00003504-00000C47-3341319228] Observed system executable string:"%WINDIR%\RSFO.exe.bat" [Source: 00000000-00003504-00000C76-3376905356] Observed system executable string:"%WINDIR%\system\JOYJ.exe" [Source: 00000000-00007752-00000C2D-2476806970] Observed system executable string:""%WINDIR%\system\JOYJ.exe.bat"" [Source: 00000000-00007752-00000C47-3335010980] Observed system executable string:"%WINDIR%\system\JOYJ.exe.bat" [Source: 00000000-00007752-00000C76-3371231062] Observed system executable string:"%WINDIR%\System\JOYJ.exe" [Source: 00000000-00006996-00000BC0-3193838767] Observed system executable string:"%WINDIR%\RCP.exe" [Source: 00000000-00002532-00000C2D-2469237898] Observed system executable string:""%WINDIR%\RCP.exe.bat"" [Source: 00000000-00002532-00000C47-3445475226] Observed system executable string:"%WINDIR%\RCP.exe.bat" [Source: 00000000-00002532-00000C76-3496618246] Observed system executable string:"%WINDIR%\system\HNHWPQB.exe" [Source: 00000000-00001536-00000C2D-2462337084] Observed system executable string:""%WINDIR%\system\HNHWPQB.exe.bat"" [Source: 00000000-00001536-00000C47-3450941226] Observed system executable string:"%WINDIR%\system\HNHWPQB.exe.bat" [Source: 00000000-00001536-00000C76-3502007214] Observed system executable string:"%WINDIR%\System\HNHWPQB.exe" [Source: 00000000-00003628-00000BC0-3198812590] Observed system executable string:"%WINDIR%\SUL.exe" [Source: 00000000-00007076-00000C2D-2469022468] Observed system executable string:""%WINDIR%\SUL.exe.bat"" [Source: 00000000-00007076-00000C47-3414377880] Observed system executable string:"%WINDIR%\SUL.exe.bat" [Source: 00000000-00007076-00000C76-3466791406] Observed system executable string:"%WINDIR%\system\MVJOU.exe" [Source: 00000000-00007420-00000C2D-2472652264] Observed system executable string:""%WINDIR%\system\MVJOU.exe.bat"" [Source: 00000000-00007420-00000C47-3530076708] Observed system executable string:"%WINDIR%\system\MVJOU.exe.bat" [Source: 00000000-00007420-00000C76-3579567282] Observed system executable string:"%WINDIR%\System\MVJOU.exe" [Source: 00000000-00004704-00000BC0-3204063203] Observed system executable string:"%WINDIR%\QEQ.exe" [Source: 00000000-00006928-00000C2D-2660672218] Observed system executable string:""%WINDIR%\QEQ.exe.bat"" [Source: 00000000-00006928-00000C47-3710622526] Observed system executable string:"%WINDIR%\QEQ.exe.bat" [Source: 00000000-00006928-00000C76-3762355688] Observed system executable string:"%WINDIR%\LYVXACA.exe" [Source: 00000000-00002864-00000C2D-2668119158] Observed system executable string:""%WINDIR%\LYVXACA.exe.bat"" [Source: 00000000-00002864-00000C47-3547410896] Observed system executable string:"%WINDIR%\LYVXACA.exe.bat" [Source: 00000000-00002864-00000C76-3583548722] Observed system executable string:"%WINDIR%\OMZLOC.exe" [Source: 00000000-00005352-00000C2D-3158815972] Observed system executable string:""%WINDIR%\OMZLOC.exe.bat"" [Source: 00000000-00005352-00000C47-4151013924] Observed system executable string:"%WINDIR%\OMZLOC.exe.bat" [Source: 00000000-00005352-00000C76-4199798822] Observed system executable string:"%WINDIR%\PQLZSP.exe" [Source: 00000000-00000940-00000C2D-2498471528] Observed system executable string:""%WINDIR%\PQLZSP.exe.bat"" [Source: 00000000-00000940-00000C47-3471374078] Observed system executable string:"%WINDIR%\PQLZSP.exe.bat" [Source: 00000000-00000940-00000C76-3522634814] Observed system executable string:"%WINDIR%\system32\RBFFNT.exe" [Source: 00000000-00004700-00000C2D-2430086410] Observed system executable string:""%WINDIR%\system32\RBFFNT.exe.bat"" [Source: 00000000-00004700-00000C47-3421805148] Observed system executable string:"%WINDIR%\system32\RBFFNT.exe.bat" [Source: 00000000-00004700-00000C76-3472852160] Observed system executable string:"%WINDIR%\SysWOW64\RBFFNT.exe" [Source: 00000000-00005556-00000BC0-3217518724] Observed system executable string:"%WINDIR%\NVE.exe" [Source: 00000000-00005596-00000C2D-2489056794] Observed system executable string:""%WINDIR%\NVE.exe.bat"" [Source: 00000000-00005596-00000C47-3458132624] Observed system executable string:"%WINDIR%\NVE.exe.bat" [Source: 00000000-00005596-00000C76-3508125034] Observed system executable string:"%WINDIR%\system\FLX.exe" [Source: 00000000-00002392-00000C2D-2366108174] Observed system executable string:""%WINDIR%\system\FLX.exe.bat"" [Source: 00000000-00002392-00000C47-3165512388] Observed system executable string:"%WINDIR%\system\FLX.exe.bat" [Source: 00000000-00002392-00000C76-3201198196] Observed system executable string:"%WINDIR%\System\FLX.exe" [Source: 00000000-00003264-00000BC0-3222285198] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\NTKA.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\SHLSGCM.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\HQJQFTK.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\OUQBA.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system32\YAU.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system32\QWNAL.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\VFFNFTJ.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\TTCMDR.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\RSFO.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\JOYJ.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\RCP.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\HNHWPQB.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\SUL.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\MVJOU.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\QEQ.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\LYVXACA.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\OMZLOC.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\PQLZSP.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system32\RBFFNT.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\NVE.exe.bat" "" [Source: cmd.exe] Observed system executable string:"%WINDIR%\system32\cmd.exe /c ""%WINDIR%\system\FLX.exe.bat" "" [Source: cmd.exe]5b:T721,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "NTKA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "NTKA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "NTKA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "NTKA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "NTKA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "NTKA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "SHLSGCM.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")5c:Tacf,Observed system executable string:"%WINDIR%\NTKAENU.dll" [Source: 00000000-00005916-00000C2B-3172343863] Observed system executable string:"%WINDIR%\NTKALOC.dll" [Source: 00000000-00005916-00000C2B-3172526890] Observed system executable string:"%WINDIR%\system\SHLSGCMENU.dll" [Source: 00000000-00007192-00000C2B-3174790806] Observed system executable string:"%WINDIR%\system\SHLSGCMLOC.dll" [Source: 00000000-00007192-00000C2B-3174928800] Observed system executable string:"%WINDIR%\system\HQJQFTKENU.dll" [Source: 00000000-00002800-00000C2B-3177241888] Observed system executable string:"%WINDIR%\system\HQJQFTKLOC.dll" [Source: 00000000-00002800-00000C2B-3177375185] Observed system executable string:"%WINDIR%\OUQBAENU.dll" [Source: 00000000-00006980-00000C2B-3179753185] Observed system executable string:"%WINDIR%\OUQBALOC.dll" [Source: 00000000-00006980-00000C2B-3179883404] Observed system executable string:"%WINDIR%\SysWOW64\YAUENU.dll" [Source: 00000000-00001116-00000C2B-3182128767] Observed system executable string:"%WINDIR%\SysWOW64\YAULOC.dll" [Source: 00000000-00001116-00000C2B-3182266138] Observed system executable string:"%WINDIR%\SysWOW64\QWNALENU.dll" [Source: 00000000-00007988-00000C2B-3184697524] Observed system executable string:"%WINDIR%\SysWOW64\QWNALLOC.dll" [Source: 00000000-00007988-00000C2B-3184834753] Observed system executable string:"%WINDIR%\VFFNFTJENU.dll" [Source: 00000000-00007844-00000C2B-3187070037] Observed system executable string:"%WINDIR%\VFFNFTJLOC.dll" [Source: 00000000-00007844-00000C2B-3187205157] Observed system executable string:"%WINDIR%\TTCMDRENU.dll" [Source: 00000000-00003504-00000C2B-3189689701] Observed system executable string:"%WINDIR%\TTCMDRLOC.dll" [Source: 00000000-00003504-00000C2B-3189824143] Observed system executable string:"%WINDIR%\RSFOENU.dll" [Source: 00000000-00007752-00000C2B-3192089500] Observed system executable string:"%WINDIR%\RSFOLOC.dll" [Source: 00000000-00007752-00000C2B-3192205188] Observed system executable string:"%WINDIR%\system\JOYJENU.dll" [Source: 00000000-00002532-00000C2B-3194486862] Observed system executable string:"%WINDIR%\system\JOYJLOC.dll" [Source: 00000000-00002532-00000C2B-3194625111] Observed system executable string:"%WINDIR%\RCPENU.dll" [Source: 00000000-00001536-00000C2B-3196931639] Observed system executable string:"%WINDIR%\RCPLOC.dll" [Source: 00000000-00001536-00000C2B-3197066186] Observed system executable string:"%WINDIR%\system\HNHWPQBENU.dll" [Source: 00000000-00007076-00000C2B-3199427951] Observed system executable string:"%WINDIR%\system\HNHWPQBLOC.dll" [Source: 00000000-00007076-00000C2B-3199557226] Observed system executable string:"%WINDIR%\SULENU.dll" [Source: 00000000-00007420-00000C2B-3201958857]5d:T67d,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" sets a windows hook with filter "WH_CBT" for thread ID 2148 "NTKA.exe" sets a windows hook with filter "WH_CBT" for thread ID 7792 "SHLSGCM.exe" sets a windows hook with filter "WH_CBT" for thread ID 7656 "HQJQFTK.exe" sets a windows hook with filter "WH_CBT" for thread ID 1204 "OUQBA.exe" sets a windows hook with filter "WH_CBT" for thread ID 7492 "YAU.exe" sets a windows hook with filter "WH_CBT" for thread ID 5136 "QWNAL.exe" sets a windows hook with filter "WH_CBT" for thread ID 6152 "VFFNFTJ.exe" sets a windows hook with filter "WH_CBT" for thread ID 7120 "TTCMDR.exe" sets a windows hook with filter "WH_CBT" for thread ID 6476 "RSFO.exe" sets a windows hook with filter "WH_CBT" for thread ID 748 "JOYJ.exe" sets a windows hook with filter "WH_CBT" for thread ID 1048 "RCP.exe" sets a windows hook with filter "WH_CBT" for thread ID 2008 "HNHWPQB.exe" sets a windows hook with filter "WH_CBT" for thread ID 3152 "SUL.exe" sets a windows hook with filter "WH_CBT" for thread ID 5796 "MVJOU.exe" sets a windows hook with filter "WH_CBT" for thread ID 3020 "QEQ.exe" sets a windows hook with filter "WH_CBT" for thread ID 5792 "LYVXACA.exe" sets a windows hook with filter "WH_CBT" for thread ID 1848 "OMZLOC.exe" sets a windows hook with filter "WH_CBT" for thread ID 1716 "PQLZSP.exe" sets a windows hook with filter "WH_CBT" for thread ID 6940 "RBFFNT.exe" sets a windows hook with filter "WH_CBT" for thread ID 7188 "NVE.exe" sets a windows hook with filter "WH_CBT" for thread ID 5240 "FLX.exe" sets a windows hook with filter "WH_CBT" for thread ID 40445e:T9c2,Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\NTKA.exe.bat" "" (UID: 00000000-00003124) Spawned process "NTKA.exe" (UID: 00000000-00005916) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\SHLSGCM.exe.b ..." (UID: 00000000-00003216) Spawned process "SHLSGCM.exe" (UID: 00000000-00007192) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\HQJQFTK.exe.b ..." (UID: 00000000-00007336) Spawned process "HQJQFTK.exe" (UID: 00000000-00002800) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\OUQBA.exe.bat" "" (UID: 00000000-00007324) Spawned process "OUQBA.exe" (UID: 00000000-00006980) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system32\\YAU.exe.bat ..." (UID: 00000000-00006108) Spawned process "YAU.exe" with commandline "%WINDIR%\\system32\\YAU.exe" (UID: 00000000-00001116) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system32\\QWNAL.exe.b ..." (UID: 00000000-00006120) Spawned process "QWNAL.exe" with commandline "%WINDIR%\\system32\\QWNAL.exe" (UID: 00000000-00007988) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\VFFNFTJ.exe.bat" "" (UID: 00000000-00007840) Spawned process "VFFNFTJ.exe" (UID: 00000000-00007844) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\TTCMDR.exe.bat" "" (UID: 00000000-00007528) Spawned process "TTCMDR.exe" (UID: 00000000-00003504) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\RSFO.exe.bat" "" (UID: 00000000-00000868) Spawned process "RSFO.exe" (UID: 00000000-00007752) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\JOYJ.exe.bat" ..." (UID: 00000000-00006996), Spawned process "JOYJ.exe" (UID: 00000000-00002532), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\RCP.exe.bat" "" (UID: 00000000-00001632), Spawned process "RCP.exe" (UID: 00000000-00001536), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\HNHWPQB.exe.b ..." (UID: 00000000-00003628), Spawned process "HNHWPQB.exe" (UID: 00000000-00007076), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\SUL.exe.bat" "" (UID: 00000000-00003648)5f:T9c2,Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\NTKA.exe.bat" "" (UID: 00000000-00003124) Spawned process "NTKA.exe" (UID: 00000000-00005916) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\SHLSGCM.exe.b ..." (UID: 00000000-00003216) Spawned process "SHLSGCM.exe" (UID: 00000000-00007192) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\HQJQFTK.exe.b ..." (UID: 00000000-00007336) Spawned process "HQJQFTK.exe" (UID: 00000000-00002800) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\OUQBA.exe.bat" "" (UID: 00000000-00007324) Spawned process "OUQBA.exe" (UID: 00000000-00006980) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system32\\YAU.exe.bat ..." (UID: 00000000-00006108) Spawned process "YAU.exe" with commandline "%WINDIR%\\system32\\YAU.exe" (UID: 00000000-00001116) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system32\\QWNAL.exe.b ..." (UID: 00000000-00006120) Spawned process "QWNAL.exe" with commandline "%WINDIR%\\system32\\QWNAL.exe" (UID: 00000000-00007988) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\VFFNFTJ.exe.bat" "" (UID: 00000000-00007840) Spawned process "VFFNFTJ.exe" (UID: 00000000-00007844) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\TTCMDR.exe.bat" "" (UID: 00000000-00007528) Spawned process "TTCMDR.exe" (UID: 00000000-00003504) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\RSFO.exe.bat" "" (UID: 00000000-00000868) Spawned process "RSFO.exe" (UID: 00000000-00007752) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\JOYJ.exe.bat" ..." (UID: 00000000-00006996), Spawned process "JOYJ.exe" (UID: 00000000-00002532), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\RCP.exe.bat" "" (UID: 00000000-00001632), Spawned process "RCP.exe" (UID: 00000000-00001536), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\HNHWPQB.exe.b ..." (UID: 00000000-00003628), Spawned process "HNHWPQB.exe" (UID: 00000000-00007076), Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\SUL.exe.bat" "" (UID: 00000000-00003648)60:T6d2,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "HQJQFTK.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "RBFFNT.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "VFFNFTJ.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "LYVXACA.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "FLX.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "PQLZSP.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "RSFO.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "MVJOU.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "OUQBA.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "YAU.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "OMZLOC.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "SHLSGCM.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "QEQ.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "NTKA.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "NVE.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "RCP.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "SUL.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "JOYJ.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "TTCMDR.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "QWNAL.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE "HNHWPQB.exe" has flags like IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE61:T15c3,"HQJQFTK.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\HQJQFTK.exe]- [targetUID: 00000000-00002800] "RBFFNT.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\SysWOW64\RBFFNT.exe]- [targetUID: 00000000-00004700] "VFFNFTJ.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\VFFNFTJ.exe]- [targetUID: 00000000-00007988] "LYVXACA.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\LYVXACA.exe]- [targetUID: 00000000-00002864] "FLX.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\FLX.exe]- [targetUID: 00000000-00002392] "PQLZSP.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\PQLZSP.exe]- [targetUID: 00000000-00000940] "RSFO.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\RSFO.exe]- [targetUID: 00000000-00003504] "MVJOU.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\MVJOU.exe]- [targetUID: 00000000-00004704] "OUQBA.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\OUQBA.exe]- [targetUID: 00000000-00002800] "YAU.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\SysWOW64\YAU.exe]- [targetUID: 00000000-00001116] "OMZLOC.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\OMZLOC.exe]- [targetUID: 00000000-00000940] "SHLSGCM.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\SHLSGCM.exe]- [targetUID: 00000000-00005916] "QEQ.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\QEQ.exe]- [targetUID: 00000000-00002864] "NTKA.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\NTKA.exe]- [targetUID: 00000000-00005916] "NVE.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\NVE.exe]- [targetUID: 00000000-00002392] "RCP.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\RCP.exe]- [targetUID: 00000000-00001632] "SUL.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\SUL.exe]- [targetUID: 00000000-00007076] "JOYJ.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\JOYJ.exe]- [targetUID: 00000000-00006996] "TTCMDR.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\TTCMDR.exe]- [targetUID: 00000000-00003504] "QWNAL.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\SysWOW64\QWNAL.exe]- [targetUID: 00000000-00001116] "HNHWPQB.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\HNHWPQB.exe]- [targetUID: 00000000-00007076] "RBFFNT.exe.bat" has type "ASCII text"- Location: [%WINDIR%\SysWOW64\RBFFNT.exe.bat]- [targetUID: 00000000-00004700] "QWNAL.exe.bat" has type "ASCII text"- Location: [%WINDIR%\SysWOW64\QWNAL.exe.bat]- [targetUID: 00000000-00001116] "HQJQFTK.exe.bat" has type "ASCII text"- Location: [%WINDIR%\System\HQJQFTK.exe.bat]- [targetUID: 00000000-00007192] "SHLSGCM.exe.bat" has type "ASCII text"- Location: [%WINDIR%\System\SHLSGCM.exe.bat]- [targetUID: 00000000-00005916] "HNHWPQB.exe.bat" has type "ASCII text"- Location: [%WINDIR%\System\HNHWPQB.exe.bat]- [targetUID: 00000000-00003628] "MVJOU.exe.bat" has type "ASCII text"- Location: [%WINDIR%\System\MVJOU.exe.bat]- [targetUID: 00000000-00004704] "YAU.exe.bat" has type "ASCII text"- Location: [%WINDIR%\SysWOW64\YAU.exe.bat]- [targetUID: 00000000-00006108] "JOYJ.exe.bat" has type "ASCII text"- Location: [%WINDIR%\System\JOYJ.exe.bat]- [targetUID: 00000000-00006996] "FLX.exe.bat" has type "ASCII text"- Location: [%WINDIR%\System\FLX.exe.bat]- [targetUID: 00000000-00002392] "LYVXACA.exe.bat" has type "ASCII text"- Location: [%WINDIR%\LYVXACA.exe.bat]- [targetUID: 00000000-00002864] "VFFNFTJ.exe.bat" has type "ASCII text"- Location: [%WINDIR%\VFFNFTJ.exe.bat]- [targetUID: 00000000-00007988] "PQLZSP.exe.bat" has type "ASCII text"- Location: [%WINDIR%\PQLZSP.exe.bat]- [targetUID: 00000000-00000940] "TTCMDR.exe.bat" has type "ASCII text"- Location: [%WINDIR%\TTCMDR.exe.bat]- [targetUID: 00000000-00007528] "OMZLOC.exe.bat" has type "ASCII text"- Location: [%WINDIR%\OMZLOC.exe.bat]- [targetUID: 00000000-00007308] "OUQBA.exe.bat" has type "ASCII text"- Location: [%WINDIR%\OUQBA.exe.bat]- [targetUID: 00000000-00002800] "RSFO.exe.bat" has type "ASCII text"- Location: [%WINDIR%\RSFO.exe.bat]- [targetUID: 00000000-00003504] "NTKA.exe.bat" has type "ASCII text"- Location: [%WINDIR%\NTKA.exe.bat]- [targetUID: 00000000-00002948] "NVE.exe.bat" has type "ASCII text"- Location: [%WINDIR%\NVE.exe.bat]- [targetUID: 00000000-00004344] "SUL.exe.bat" has type "ASCII text"- Location: [%WINDIR%\SUL.exe.bat]- [targetUID: 00000000-00007076] "RCP.exe.bat" has type "ASCII text"- Location: [%WINDIR%\RCP.exe.bat]- [targetUID: 00000000-00001632] "QEQ.exe.bat" has type "ASCII text"- Location: [%WINDIR%\QEQ.exe.bat]- [targetUID: 00000000-00006928]62:Te14,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")63:Ta6b,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\System32\sihost.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\System32\svchost.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\System32\taskhostw.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\System32\ctfmon.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\explorer.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\System32\RuntimeBroker.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\System32\ApplicationFrameHost.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Program Files\WindowsApps\Microsoft.WindowsStore_11810.1001.12.0_x64__8wekyb3d8bbwe\WinStore.App.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\System32\backgroundTaskHost.exe" (UID: 2948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" queries basic process information of the "C:\Windows\System32\conhost.exe" (UID: 2948)64:T1339,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")65:T495,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" reads file "c:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" reads file "c:\windows\ntka.exe" "cmd.exe" reads file "c:\windows\ntka.exe.bat" "NTKA.exe" reads file "c:\windows\ntka.exe" "NTKA.exe" reads file "c:\windows\system\shlsgcm.exe" "cmd.exe" reads file "c:\windows\system\shlsgcm.exe.bat" "SHLSGCM.exe" reads file "c:\windows\system\shlsgcm.exe" "SHLSGCM.exe" reads file "c:\windows\system\hqjqftk.exe" "cmd.exe" reads file "c:\windows\system\hqjqftk.exe.bat" "HQJQFTK.exe" reads file "c:\windows\system\hqjqftk.exe" "HQJQFTK.exe" reads file "c:\windows\ouqba.exe" "cmd.exe" reads file "c:\windows\ouqba.exe.bat" "OUQBA.exe" reads file "c:\windows\ouqba.exe" "OUQBA.exe" reads file "c:\windows\syswow64\yau.exe" "cmd.exe" reads file "c:\windows\syswow64\yau.exe.bat" "YAU.exe" reads file "c:\windows\syswow64\yau.exe" "YAU.exe" reads file "c:\windows\syswow64\qwnal.exe" "cmd.exe" reads file "c:\windows\syswow64\qwnal.exe.bat" "QWNAL.exe" reads file "c:\windows\syswow64\qwnal.exe"66:T4a1,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to touch file "C:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb"67:T621,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched file "C:\Windows\NTKA.exe" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched file "C:\Windows\NTKA.exe.bat" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "NTKA.exe" touched file "C:\Windows\System\SHLSGCM.exe" "NTKA.exe" touched file "C:\Windows\System\SHLSGCM.exe.bat" "NTKA.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "NTKA.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "SHLSGCM.exe" touched file "C:\Windows\System\HQJQFTK.exe" "SHLSGCM.exe" touched file "C:\Windows\System\HQJQFTK.exe.bat" "SHLSGCM.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "SHLSGCM.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "HQJQFTK.exe" touched file "C:\Windows\OUQBA.exe" "HQJQFTK.exe" touched file "C:\Windows\OUQBA.exe.bat" "HQJQFTK.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "HQJQFTK.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "OUQBA.exe" touched file "C:\Windows\SysWOW64\YAU.exe" "OUQBA.exe" touched file "C:\Windows\SysWOW64\YAU.exe.bat" "OUQBA.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "OUQBA.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"68:T8eb,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\BCRYPT.DLL" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\bcrypt.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\FLTLIB.DLL" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\MSVCP140.DLL" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\MSVCP140.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\9956D4433D4B79E68436785A40CEE5FD65CFD498E2E428991EAA05AEE7E3E757ENU.DLL" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757ENU.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\9956D4433D4B79E68436785A40CEE5FD65CFD498E2E428991EAA05AEE7E3E757LOC.DLL" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757LOC.dll" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL"69:Ta88,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\9956D4433D4B79E68436785A40CEE5FD65CFD498E2E428991EAA05AEE7E3E757.EXE.2.MANIFEST" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\9956D4433D4B79E68436785A40CEE5FD65CFD498E2E428991EAA05AEE7E3E757.EXE.3.MANIFEST" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\9956D4433D4B79E68436785A40CEE5FD65CFD498E2E428991EAA05AEE7E3E757.EXE.CONFIG" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\9956D4433D4B79E68436785A40CEE5FD65CFD498E2E428991EAA05AEE7E3E757.EXE.1000.MANIFEST" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\9956D4433D4B79E68436785A40CEE5FD65CFD498E2E428991EAA05AEE7E3E757.EXE.LOCAL" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe.Local\" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\Windows\NTKA.exe.bat:ZONE.IDENTIFIER" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" trying to access non-existent file "C:\windows\NTKA.exe.bat:Zone.Identifier" "cmd.exe" trying to access non-existent file "C:\Windows\SysWOW64\AppLocker\MDM" "cmd.exe" trying to access non-existent file "C:\Windows\NTKA.EXE.BAT" "NTKA.exe" trying to access non-existent file "C:\Windows\WINSPOOL.DRV" "NTKA.exe" trying to access non-existent file "C:\windows\WINSPOOL.DRV" "NTKA.exe" trying to access non-existent file "C:\Windows\NTKA.EXE.2.MANIFEST" "NTKA.exe" trying to access non-existent file "C:\Windows\NTKA.EXE.3.MANIFEST" "NTKA.exe" trying to access non-existent file "C:\Windows\NTKA.EXE.CONFIG" "NTKA.exe" trying to access non-existent file "C:\Windows\NTKA.EXE.1000.MANIFEST" "NTKA.exe" trying to access non-existent file "C:\Windows\NTKA.EXE.LOCAL" "NTKA.exe" trying to access non-existent file "C:\windows\NTKA.exe.Local\" "NTKA.exe" trying to access non-existent file "C:\Windows\System\SHLSGCM.exe.bat:ZONE.IDENTIFIER" "NTKA.exe" trying to access non-existent file "C:\windows\system\SHLSGCM.exe.bat:Zone.Identifier" "cmd.exe" trying to access non-existent file "C:\Windows\System\SHLSGCM.EXE.BAT" "SHLSGCM.exe" trying to access non-existent file "C:\Windows\System\WINSPOOL.DRV"6a:Tee4,Found string "+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found string "B+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found string "+ncalrpc:[OLEC8AB70462E127C104C9C3A295F51]" (Indicator: "ncalrpc"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found string "+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found string "B+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found string "+ncalrpc:[OLE3A1F4FAF59DB39D526F293732B46]" (Indicator: "ncalrpc"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found string "+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00001536.00000000.269334.02C80000.00000004.mdmp") Found string "B+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00001536.00000000.269334.02C80000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001536.00000000.269334.02C80000.00000004.mdmp") Found string "+ncalrpc:[OLE8E67CCF7F614B191C02E77C44E96]" (Indicator: "ncalrpc"; Source: "00000000-00001536.00000000.269334.02C80000.00000004.mdmp") Found string "+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00002392.00000000.270848.02A30000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002392.00000000.270848.02A30000.00000004.mdmp") Found string "B+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00002392.00000000.270848.02A30000.00000004.mdmp") Found string "+ncalrpc:[OLE34FCA7958428C157C9AD04A3EC1F]" (Indicator: "ncalrpc"; Source: "00000000-00002392.00000000.270848.02A30000.00000004.mdmp") Found string "+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00002532.00000000.269175.03340000.00000004.mdmp") Found string "B+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00002532.00000000.269175.03340000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002532.00000000.269175.03340000.00000004.mdmp") Found string "+ncalrpc:[OLE77A1A39D3E3D0E97C0A7046DA0D4]" (Indicator: "ncalrpc"; Source: "00000000-00002532.00000000.269175.03340000.00000004.mdmp") Found string "B+ncalrpc:[OLEF7" (Indicator: "ncalrpc"; Source: "00000000-00002532.00000000.269175.03340000.00000004.mdmp") Found string "B+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00002800.00000000.268071.03500000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002800.00000000.268071.03500000.00000004.mdmp") Found string "+ncalrpc:[OLEF8CEE532BA18F0217DACF28000E8]" (Indicator: "ncalrpc"; Source: "00000000-00002800.00000000.268071.03500000.00000004.mdmp") Found string "+ncalrpc:[OLEF7C2B6A2646C66E0745DE5DFA64E]" (Indicator: "ncalrpc"; Source: "00000000-00002800.00000000.268071.03500000.00000004.mdmp")6b:Tfba,Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetDC" (Indicator: "GetDC"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000940.00000000.270374.034A0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001116.00000000.268389.02DE0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001536.00000000.269334.02C80000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001536.00000000.269334.02C80000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001536.00000000.269334.02C80000.00000004.mdmp")6c:Tb34,Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: HQJQFTK.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: RBFFNT.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: VFFNFTJ.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: LYVXACA.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: FLX.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: PQLZSP.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: RSFO.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: MVJOU.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: OUQBA.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: YAU.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: OMZLOC.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: SHLSGCM.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: QEQ.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: NTKA.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: NVE.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: RCP.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: SUL.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: JOYJ.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: TTCMDR.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: QWNAL.exe] Observed import api "GetCommandLineA" which can "retrieve the command-line string for the current process" [Source: HNHWPQB.exe]6d:Ta80,Found registry query API: "RegOpenKeyA" in file "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" Found registry query API: "RegEnumKeyA" in file "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" Found registry query API: "RegQueryValueA" in file "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" Found registry query API: "RegQueryValueExA" in file "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" Found registry query API: "RegOpenKeyExA" in file "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" Found registry query API: "RegOpenKeyA" in "00000000-00000940.00000000.270374.056C0000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00000940.00000000.270374.056C0000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000940.00000000.270374.056C0000.00000004.mdmp" Found registry query API: "RegEnumKeyA" in "00000000-00000940.00000000.270374.056C0000.00000004.mdmp" Found registry query API: "RegQueryValueA" in "00000000-00000940.00000000.270374.056C0000.00000004.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00001116.00000000.268389.05000000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001116.00000000.268389.05000000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00001116.00000000.268389.05000000.00000004.mdmp" Found registry query API: "RegEnumKeyA" in "00000000-00001116.00000000.268389.05000000.00000004.mdmp" Found registry query API: "RegQueryValueA" in "00000000-00001116.00000000.268389.05000000.00000004.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00001536.00000000.269334.04D80000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00001536.00000000.269334.04D80000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00001536.00000000.269334.04D80000.00000004.mdmp" Found registry query API: "RegEnumKeyA" in "00000000-00001536.00000000.269334.04D80000.00000004.mdmp" Found registry query API: "RegQueryValueA" in "00000000-00001536.00000000.269334.04D80000.00000004.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00002392.00000000.270848.04C60000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002392.00000000.270848.04C60000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002392.00000000.270848.04C60000.00000004.mdmp" Found registry query API: "RegEnumKeyA" in "00000000-00002392.00000000.270848.04C60000.00000004.mdmp" Found registry query API: "RegQueryValueA" in "00000000-00002392.00000000.270848.04C60000.00000004.mdmp"6e:T929,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")6f:Tab9,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "FindFirstFileA" with parameter c:\stop-adw.txt (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "FindFirstFileA" with parameter C:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe (UID: 00000000-00002948) "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "FindFirstFileA" with parameter %WINDIR%\NTKA.exe (UID: 00000000-00002948) "NTKA.exe" called "FindFirstFileA" with parameter c:\stop-adw.txt (UID: 00000000-00005916) "NTKA.exe" called "FindFirstFileA" with parameter C:\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe (UID: 00000000-00005916) "NTKA.exe" called "FindFirstFileA" with parameter %WINDIR%\NTKA.exe (UID: 00000000-00005916) "NTKA.exe" called "FindFirstFileA" with parameter %WINDIR%\system\SHLSGCM.exe (UID: 00000000-00005916) "SHLSGCM.exe" called "FindFirstFileA" with parameter c:\stop-adw.txt (UID: 00000000-00007192) "SHLSGCM.exe" called "FindFirstFileA" with parameter %WINDIR%\NTKA.exe (UID: 00000000-00007192) "SHLSGCM.exe" called "FindFirstFileA" with parameter %WINDIR%\system\SHLSGCM.exe (UID: 00000000-00007192) "SHLSGCM.exe" called "FindFirstFileA" with parameter %WINDIR%\system\HQJQFTK.exe (UID: 00000000-00007192) "HQJQFTK.exe" called "FindFirstFileA" with parameter c:\stop-adw.txt (UID: 00000000-00002800) "HQJQFTK.exe" called "FindFirstFileA" with parameter %WINDIR%\system\SHLSGCM.exe (UID: 00000000-00002800) "HQJQFTK.exe" called "FindFirstFileA" with parameter %WINDIR%\system\HQJQFTK.exe (UID: 00000000-00002800) "HQJQFTK.exe" called "FindFirstFileA" with parameter %WINDIR%\OUQBA.exe (UID: 00000000-00002800) "OUQBA.exe" called "FindFirstFileA" with parameter c:\stop-adw.txt (UID: 00000000-00006980) "OUQBA.exe" called "FindFirstFileA" with parameter %WINDIR%\system\HQJQFTK.exe (UID: 00000000-00006980) "OUQBA.exe" called "FindFirstFileA" with parameter %WINDIR%\OUQBA.exe (UID: 00000000-00006980) "OUQBA.exe" called "FindFirstFileA" with parameter %WINDIR%\system32\YAU.exe (UID: 00000000-00006980) "YAU.exe" called "FindFirstFileA" with parameter c:\stop-adw.txt (UID: 00000000-00001116) "YAU.exe" called "FindFirstFileA" with parameter %WINDIR%\OUQBA.exe (UID: 00000000-00001116) "YAU.exe" called "FindFirstFileA" with parameter %WINDIR%\SysWOW64\YAU.exe (UID: 00000000-00001116) "YAU.exe" called "FindFirstFileA" with parameter %WINDIR%\system32\QWNAL.exe (UID: 00000000-00001116) "QWNAL.exe" called "FindFirstFileA" with parameter c:\stop-adw.txt (UID: 00000000-00007988) "QWNAL.exe" called "FindFirstFileA" with parameter %WINDIR%\SysWOW64\YAU.exe (UID: 00000000-00007988)70:T437,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "cmd.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "NTKA.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "SHLSGCM.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "HQJQFTK.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "OUQBA.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "YAU.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "QWNAL.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "VFFNFTJ.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "TTCMDR.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"}71:T59e,Found GetCursorPos() in an import section (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757) Found GetCursorPos() in an import section (Source: HQJQFTK.exe) Found GetCursorPos() in an import section (Source: RBFFNT.exe) Found GetCursorPos() in an import section (Source: VFFNFTJ.exe) Found GetCursorPos() in an import section (Source: LYVXACA.exe) Found GetCursorPos() in an import section (Source: FLX.exe) Found GetCursorPos() in an import section (Source: PQLZSP.exe) Found GetCursorPos() in an import section (Source: RSFO.exe) Found GetCursorPos() in an import section (Source: MVJOU.exe) Found GetCursorPos() in an import section (Source: OUQBA.exe) Found GetCursorPos() in an import section (Source: YAU.exe) Found GetCursorPos() in an import section (Source: OMZLOC.exe) Found GetCursorPos() in an import section (Source: SHLSGCM.exe) Found GetCursorPos() in an import section (Source: QEQ.exe) Found GetCursorPos() in an import section (Source: NTKA.exe) Found GetCursorPos() in an import section (Source: NVE.exe) Found GetCursorPos() in an import section (Source: RCP.exe) Found GetCursorPos() in an import section (Source: SUL.exe) Found GetCursorPos() in an import section (Source: JOYJ.exe) Found GetCursorPos() in an import section (Source: TTCMDR.exe) Found GetCursorPos() in an import section (Source: QWNAL.exe) Found GetCursorPos() in an import section (Source: HNHWPQB.exe)72:T404,Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")73:Te6b,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp")74:T420,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")75:T40b,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")76:T451,Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "InterlockedExchange" (Indicator: "InterlockedExchange"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")77:T811,Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "PathFindFileNameA" (Indicator: "PathFindFileName"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "PathFindFileNameA" (Indicator: "PathFindFileName"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "PathFindFileNameA" (Indicator: "PathFindFileName"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "PathFindFileNameA" (Indicator: "PathFindFileName"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "PathFindFileNameA" (Indicator: "PathFindFileName"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "PathFindFileNameA" (Indicator: "PathFindFileName"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "PathFindFileNameA" (Indicator: "PathFindFileName"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")78:Tcc6,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetModuleFileNameExA" (Indicator: "GetModuleFileName"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")79:T427,Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")7a:T8cc,Observed import api "OpenProcess" which can be "used to open a process handle" [Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: HQJQFTK.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: RBFFNT.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: VFFNFTJ.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: LYVXACA.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: FLX.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: PQLZSP.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: RSFO.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: MVJOU.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: OUQBA.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: YAU.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: OMZLOC.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: SHLSGCM.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: QEQ.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: NTKA.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: NVE.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: RCP.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: SUL.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: JOYJ.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: TTCMDR.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: QWNAL.exe] Observed import api "OpenProcess" which can be "used to open a process handle" [Source: HNHWPQB.exe]7b:Tc64,Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")7c:T466,Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")7d:Tc02,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000940.00000000.270374.056C0000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001116.00000000.268389.05000000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00001536.00000000.269334.04D80000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002392.00000000.270848.04C60000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002532.00000000.269175.056B0000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp")7e:Tf27,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\NTKA.EXE"; Value: "") "NTKA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM\SHLSGCM.EXE"; Value: "") "SHLSGCM.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM\HQJQFTK.EXE"; Value: "") "HQJQFTK.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\OUQBA.EXE"; Value: "") "OUQBA.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\YAU.EXE"; Value: "") "YAU.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\QWNAL.EXE"; Value: "") "QWNAL.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\VFFNFTJ.EXE"; Value: "") "VFFNFTJ.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\TTCMDR.EXE"; Value: "") "TTCMDR.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CMD.EXE"; Value: "")7f:T3598,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "NTKA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "NTKA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "NTKA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "NTKA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "SHLSGCM.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "SHLSGCM.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "SHLSGCM.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "SHLSGCM.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "HQJQFTK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "HQJQFTK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "HQJQFTK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "HQJQFTK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "OUQBA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "OUQBA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "OUQBA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "OUQBA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "YAU.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "YAU.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "YAU.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "YAU.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "QWNAL.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "QWNAL.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "QWNAL.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "QWNAL.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "VFFNFTJ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "VFFNFTJ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "VFFNFTJ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "VFFNFTJ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "TTCMDR.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "TTCMDR.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "TTCMDR.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "TTCMDR.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "RSFO.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "RSFO.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "RSFO.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "RSFO.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "JOYJ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "JOYJ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "JOYJ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "JOYJ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "RCP.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "RCP.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "RCP.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "RCP.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "HNHWPQB.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "HNHWPQB.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "HNHWPQB.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "HNHWPQB.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "SUL.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "SUL.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "SUL.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "SUL.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "MVJOU.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "MVJOU.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "MVJOU.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "MVJOU.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "QEQ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "QEQ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "QEQ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "QEQ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "LYVXACA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "LYVXACA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "LYVXACA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "LYVXACA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "OMZLOC.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "OMZLOC.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "OMZLOC.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "OMZLOC.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "PQLZSP.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "PQLZSP.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "PQLZSP.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "PQLZSP.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "RBFFNT.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "RBFFNT.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "RBFFNT.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "RBFFNT.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "NVE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "NVE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "NVE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "NVE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000")80:Tdb0,Found string "DeactivateActCtx" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNELBASE.DLL) Found string "ActivateActCtx" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNELBASE.DLL) Found string "ReleaseActCtx" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNELBASE.DLL) Found string "CreateActCtxA" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNEL32.DLL) Found string "GetSystemDefaultUILanguage" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNELBASE.DLL) Found string "GetUserDefaultUILanguage" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNELBASE.DLL) Found string "CreateActCtxW" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNELBASE.DLL) Found string "EnumDisplayDevicesA" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: USER32.DLL) Found string "GetMonitorInfoA" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: USER32.DLL) Found string "EnumDisplayMonitors" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: USER32.DLL) Found string "MonitorFromPoint" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: USER32.DLL) Found string "MonitorFromRect" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: USER32.DLL) Found string "MonitorFromWindow" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: USER32.DLL) Found string "InitCommonControls" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: COMCTL32.DLL) Found string "InitCommonControlsEx" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: COMCTL32.DLL) Found string "NotifyWinEvent" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: USER32.DLL) Found string "FlsFree" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNELBASE.DLL) Found string "InitializeCriticalSectionAndSpinCount" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: KERNELBASE.DLL) Found string "GetProcessWindowStation" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: USER32.DLL) Found string "GetUserObjectInformationA" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: USER32.DLL) Found string "NtResumeProcess" (Source: 9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757, API is part of module: NTDLL.DLL)81:T603,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "NTKA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "NTKA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "SHLSGCM.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "SHLSGCM.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "HQJQFTK.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "HQJQFTK.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "OUQBA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "OUQBA.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "YAU.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "YAU.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "QWNAL.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK")82:T43e,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe queries ProcessDebugPort (UID: 2948), "NTKA.exe queries ProcessDebugPort (UID: 5916) "SHLSGCM.exe queries ProcessDebugPort (UID: 7192), "HQJQFTK.exe queries ProcessDebugPort (UID: 2800) "OUQBA.exe queries ProcessDebugPort (UID: 6980), "YAU.exe queries ProcessDebugPort (UID: 1116) "QWNAL.exe queries ProcessDebugPort (UID: 7988), "VFFNFTJ.exe queries ProcessDebugPort (UID: 7844) "TTCMDR.exe queries ProcessDebugPort (UID: 3504), "RSFO.exe queries ProcessDebugPort (UID: 7752) "JOYJ.exe queries ProcessDebugPort (UID: 2532), "RCP.exe queries ProcessDebugPort (UID: 1536) "HNHWPQB.exe queries ProcessDebugPort (UID: 7076), "SUL.exe queries ProcessDebugPort (UID: 7420) "MVJOU.exe queries ProcessDebugPort (UID: 6928), "QEQ.exe queries ProcessDebugPort (UID: 2864) "LYVXACA.exe queries ProcessDebugPort (UID: 5352), "OMZLOC.exe queries ProcessDebugPort (UID: 940) "PQLZSP.exe queries ProcessDebugPort (UID: 4700), "RBFFNT.exe queries ProcessDebugPort (UID: 5596) "NVE.exe queries ProcessDebugPort (UID: 2392)83:T7f4,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "NTKA.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "NTKA.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "NTKA.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "NTKA.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "NTKA.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "NTKA.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "NTKA.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "SHLSGCM.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "SHLSGCM.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "SHLSGCM.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "SHLSGCM.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "SHLSGCM.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "SHLSGCM.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "SHLSGCM.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "HQJQFTK.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "HQJQFTK.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "HQJQFTK.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "HQJQFTK.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini"84:Tcb9,"HQJQFTK.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\HQJQFTK.exe]- [targetUID: 00000000-00002800] "RBFFNT.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\SysWOW64\RBFFNT.exe]- [targetUID: 00000000-00004700] "VFFNFTJ.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\VFFNFTJ.exe]- [targetUID: 00000000-00007988] "LYVXACA.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\LYVXACA.exe]- [targetUID: 00000000-00002864] "FLX.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\FLX.exe]- [targetUID: 00000000-00002392] "PQLZSP.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\PQLZSP.exe]- [targetUID: 00000000-00000940] "RSFO.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\RSFO.exe]- [targetUID: 00000000-00003504] "MVJOU.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\MVJOU.exe]- [targetUID: 00000000-00004704] "OUQBA.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\OUQBA.exe]- [targetUID: 00000000-00002800] "YAU.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\SysWOW64\YAU.exe]- [targetUID: 00000000-00001116] "OMZLOC.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\OMZLOC.exe]- [targetUID: 00000000-00000940] "SHLSGCM.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\SHLSGCM.exe]- [targetUID: 00000000-00005916] "QEQ.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\QEQ.exe]- [targetUID: 00000000-00002864] "NTKA.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\NTKA.exe]- [targetUID: 00000000-00005916] "NVE.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\NVE.exe]- [targetUID: 00000000-00002392] "RCP.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\RCP.exe]- [targetUID: 00000000-00001632] "SUL.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\SUL.exe]- [targetUID: 00000000-00007076] "JOYJ.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\JOYJ.exe]- [targetUID: 00000000-00006996] "TTCMDR.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\TTCMDR.exe]- [targetUID: 00000000-00003504] "QWNAL.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\SysWOW64\QWNAL.exe]- [targetUID: 00000000-00001116] "HNHWPQB.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections"- Location: [%WINDIR%\System\HNHWPQB.exe]- [targetUID: 00000000-00007076]85:T1ddc,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\NTKA.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "NTKA.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\System\SHLSGCM.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SHLSGCM.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\System\HQJQFTK.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "HQJQFTK.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\OUQBA.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OUQBA.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\SysWOW64\YAU.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "YAU.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\SysWOW64\QWNAL.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "QWNAL.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\VFFNFTJ.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "VFFNFTJ.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\TTCMDR.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "TTCMDR.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\RSFO.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "RSFO.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\System\JOYJ.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "JOYJ.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\RCP.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "RCP.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\System\HNHWPQB.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "HNHWPQB.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\SUL.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SUL.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\System\MVJOU.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "MVJOU.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\QEQ.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "QEQ.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\LYVXACA.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "LYVXACA.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\OMZLOC.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "OMZLOC.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\PQLZSP.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "PQLZSP.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\SysWOW64\RBFFNT.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "RBFFNT.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\NVE.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "NVE.exe" wrote 16384 bytes starting with PE header signature to file "C:\Windows\System\FLX.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...86:T582,"cmd.exe" opened "C:\Windows\NTKA.exe.bat" with delete access "cmd.exe" opened "C:\Windows\System\SHLSGCM.exe.bat" with delete access "cmd.exe" opened "C:\Windows\System\HQJQFTK.exe.bat" with delete access "cmd.exe" opened "C:\Windows\OUQBA.exe.bat" with delete access "cmd.exe" opened "C:\Windows\SysWOW64\YAU.exe.bat" with delete access "cmd.exe" opened "C:\Windows\SysWOW64\QWNAL.exe.bat" with delete access "cmd.exe" opened "C:\Windows\VFFNFTJ.exe.bat" with delete access "cmd.exe" opened "C:\Windows\TTCMDR.exe.bat" with delete access "cmd.exe" opened "C:\Windows\RSFO.exe.bat" with delete access "cmd.exe" opened "C:\Windows\System\JOYJ.exe.bat" with delete access "cmd.exe" opened "C:\Windows\RCP.exe.bat" with delete access "cmd.exe" opened "C:\Windows\System\HNHWPQB.exe.bat" with delete access "cmd.exe" opened "C:\Windows\SUL.exe.bat" with delete access "cmd.exe" opened "C:\Windows\System\MVJOU.exe.bat" with delete access "cmd.exe" opened "C:\Windows\QEQ.exe.bat" with delete access "cmd.exe" opened "C:\Windows\LYVXACA.exe.bat" with delete access "cmd.exe" opened "C:\Windows\OMZLOC.exe.bat" with delete access "cmd.exe" opened "C:\Windows\PQLZSP.exe.bat" with delete access "cmd.exe" opened "C:\Windows\SysWOW64\RBFFNT.exe.bat" with delete access "cmd.exe" opened "C:\Windows\NVE.exe.bat" with delete access "cmd.exe" opened "C:\Windows\System\FLX.exe.bat" with delete access87:T85b,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "NTKA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "SHLSGCM.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "HQJQFTK.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "OUQBA.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "YAU.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "QWNAL.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "VFFNFTJ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "TTCMDR.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "RSFO.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "JOYJ.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "RCP.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "HNHWPQB.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000")88:T59e,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757" claimed CRC 267791 while the actual is CRC 239874 "HQJQFTK.exe" claimed CRC 267791 while the actual is CRC 243618 "RBFFNT.exe" claimed CRC 267791 while the actual is CRC 234983 "VFFNFTJ.exe" claimed CRC 267791 while the actual is CRC 264782 "LYVXACA.exe" claimed CRC 267791 while the actual is CRC 259343 "FLX.exe" claimed CRC 267791 while the actual is CRC 228317 "PQLZSP.exe" claimed CRC 267791 while the actual is CRC 263527 "RSFO.exe" claimed CRC 267791 while the actual is CRC 262787 "MVJOU.exe" claimed CRC 267791 while the actual is CRC 224476 "OUQBA.exe" claimed CRC 267791 while the actual is CRC 228904 "YAU.exe" claimed CRC 267791 while the actual is CRC 276304 "OMZLOC.exe" claimed CRC 267791 while the actual is CRC 246803 "SHLSGCM.exe" claimed CRC 267791 while the actual is CRC 223768 "QEQ.exe" claimed CRC 267791 while the actual is CRC 271176 "NTKA.exe" claimed CRC 267791 while the actual is CRC 228224 "NVE.exe" claimed CRC 267791 while the actual is CRC 261546 "RCP.exe" claimed CRC 267791 while the actual is CRC 230807 "SUL.exe" claimed CRC 267791 while the actual is CRC 275820 "JOYJ.exe" claimed CRC 267791 while the actual is CRC 223906 "TTCMDR.exe" claimed CRC 267791 while the actual is CRC 224065 "QWNAL.exe" claimed CRC 267791 while the actual is CRC 259124 "HNHWPQB.exe" claimed CRC 267791 while the actual is CRC 27074889:T930,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" called "CreateProcessW" with parameter ""%WINDIR%\NTKA.exe.bat"" - (UID: 00000000-00002948) "NTKA.exe" called "CreateProcessW" with parameter ""%WINDIR%\system\SHLSGCM.exe.bat"" - (UID: 00000000-00005916) "SHLSGCM.exe" called "CreateProcessW" with parameter ""%WINDIR%\system\HQJQFTK.exe.bat"" - (UID: 00000000-00007192) "HQJQFTK.exe" called "CreateProcessW" with parameter ""%WINDIR%\OUQBA.exe.bat"" - (UID: 00000000-00002800) "OUQBA.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\YAU.exe.bat"" - (UID: 00000000-00006980) "YAU.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\QWNAL.exe.bat"" - (UID: 00000000-00001116) "QWNAL.exe" called "CreateProcessW" with parameter ""%WINDIR%\VFFNFTJ.exe.bat"" - (UID: 00000000-00007988) "VFFNFTJ.exe" called "CreateProcessW" with parameter ""%WINDIR%\TTCMDR.exe.bat"" - (UID: 00000000-00007844) "TTCMDR.exe" called "CreateProcessW" with parameter ""%WINDIR%\RSFO.exe.bat"" - (UID: 00000000-00003504) "RSFO.exe" called "CreateProcessW" with parameter ""%WINDIR%\system\JOYJ.exe.bat"" - (UID: 00000000-00007752) "JOYJ.exe" called "CreateProcessW" with parameter ""%WINDIR%\RCP.exe.bat"" - (UID: 00000000-00002532) "RCP.exe" called "CreateProcessW" with parameter ""%WINDIR%\system\HNHWPQB.exe.bat"" - (UID: 00000000-00001536) "HNHWPQB.exe" called "CreateProcessW" with parameter ""%WINDIR%\SUL.exe.bat"" - (UID: 00000000-00007076) "SUL.exe" called "CreateProcessW" with parameter ""%WINDIR%\system\MVJOU.exe.bat"" - (UID: 00000000-00007420) "MVJOU.exe" called "CreateProcessW" with parameter ""%WINDIR%\QEQ.exe.bat"" - (UID: 00000000-00006928) "QEQ.exe" called "CreateProcessW" with parameter ""%WINDIR%\LYVXACA.exe.bat"" - (UID: 00000000-00002864) "LYVXACA.exe" called "CreateProcessW" with parameter ""%WINDIR%\OMZLOC.exe.bat"" - (UID: 00000000-00005352) "OMZLOC.exe" called "CreateProcessW" with parameter ""%WINDIR%\PQLZSP.exe.bat"" - (UID: 00000000-00000940) "PQLZSP.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\RBFFNT.exe.bat"" - (UID: 00000000-00004700) "RBFFNT.exe" called "CreateProcessW" with parameter ""%WINDIR%\NVE.exe.bat"" - (UID: 00000000-00005596) "NVE.exe" called "CreateProcessW" with parameter ""%WINDIR%\system\FLX.exe.bat"" - (UID: 00000000-00002392)8a:Ta22,19/27 Antivirus vendors marked dropped file "HQJQFTK.exe" as malicious (classified as "Trojan.Agent" with 70% detection rate) 18/26 Antivirus vendors marked dropped file "RBFFNT.exe" as malicious (classified as "Trojan.Agent" with 69% detection rate) 18/23 Antivirus vendors marked dropped file "VFFNFTJ.exe" as malicious (classified as "Trojan.Agent" with 78% detection rate) 19/27 Antivirus vendors marked dropped file "LYVXACA.exe" as malicious (classified as "Agent" with 70% detection rate) 18/26 Antivirus vendors marked dropped file "FLX.exe" as malicious (classified as "Trojan.Agent" with 69% detection rate) 19/27 Antivirus vendors marked dropped file "PQLZSP.exe" as malicious (classified as "Trojan.Agent" with 70% detection rate) 18/26 Antivirus vendors marked dropped file "RSFO.exe" as malicious (classified as "Trojan.Agent" with 69% detection rate) 18/24 Antivirus vendors marked dropped file "MVJOU.exe" as malicious (classified as "Trojan.Agent" with 75% detection rate) 18/24 Antivirus vendors marked dropped file "OUQBA.exe" as malicious (classified as "Agent" with 75% detection rate) 18/23 Antivirus vendors marked dropped file "YAU.exe" as malicious (classified as "Trojan.Agent" with 78% detection rate) 18/24 Antivirus vendors marked dropped file "OMZLOC.exe" as malicious (classified as "Trojan.Agent" with 75% detection rate) 18/26 Antivirus vendors marked dropped file "SHLSGCM.exe" as malicious (classified as "Trojan.Agent" with 69% detection rate) 18/23 Antivirus vendors marked dropped file "QEQ.exe" as malicious (classified as "Trojan.Agent" with 78% detection rate) 18/23 Antivirus vendors marked dropped file "NTKA.exe" as malicious (classified as "Trojan.Agent" with 78% detection rate) 18/26 Antivirus vendors marked dropped file "NVE.exe" as malicious (classified as "Trojan.Agent" with 69% detection rate) 18/26 Antivirus vendors marked dropped file "RCP.exe" as malicious (classified as "Trojan.Agent" with 69% detection rate) 18/23 Antivirus vendors marked dropped file "SUL.exe" as malicious (classified as "Trojan.Agent" with 78% detection rate) 18/23 Antivirus vendors marked dropped file "JOYJ.exe" as malicious (classified as "Trojan.Agent" with 78% detection rate) 18/26 Antivirus vendors marked dropped file "TTCMDR.exe" as malicious (classified as "Agent" with 69% detection rate) 18/24 Antivirus vendors marked dropped file "QWNAL.exe" as malicious (classified as "Trojan.Agent" with 75% detection rate) 18/23 Antivirus vendors marked dropped file "HNHWPQB.exe" as malicious (classified as "Agent" with 78% detection rate)8b:Tad1,18/26 Antivirus vendors marked spawned process "SHLSGCM.exe" (PID: 7192) as malicious (classified as "Trojan.Agent" with 69% detection rate) 19/27 Antivirus vendors marked spawned process "HQJQFTK.exe" (PID: 2800) as malicious (classified as "Trojan.Agent" with 70% detection rate) 18/24 Antivirus vendors marked spawned process "OUQBA.exe" (PID: 6980) as malicious (classified as "Agent" with 75% detection rate) 18/23 Antivirus vendors marked spawned process "YAU.exe" (PID: 1116) as malicious (classified as "Trojan.Agent" with 78% detection rate) 18/24 Antivirus vendors marked spawned process "QWNAL.exe" (PID: 7988) as malicious (classified as "Trojan.Agent" with 75% detection rate) 18/23 Antivirus vendors marked spawned process "VFFNFTJ.exe" (PID: 7844) as malicious (classified as "Trojan.Agent" with 78% detection rate) 18/26 Antivirus vendors marked spawned process "TTCMDR.exe" (PID: 3504) as malicious (classified as "Agent" with 69% detection rate) 18/26 Antivirus vendors marked spawned process "RSFO.exe" (PID: 7752) as malicious (classified as "Trojan.Agent" with 69% detection rate) 18/23 Antivirus vendors marked spawned process "JOYJ.exe" (PID: 2532) as malicious (classified as "Trojan.Agent" with 78% detection rate) 18/26 Antivirus vendors marked spawned process "RCP.exe" (PID: 1536) as malicious (classified as "Trojan.Agent" with 69% detection rate) 18/23 Antivirus vendors marked spawned process "HNHWPQB.exe" (PID: 7076) as malicious (classified as "Agent" with 78% detection rate) 18/23 Antivirus vendors marked spawned process "SUL.exe" (PID: 7420) as malicious (classified as "Trojan.Agent" with 78% detection rate) 18/24 Antivirus vendors marked spawned process "MVJOU.exe" (PID: 6928) as malicious (classified as "Trojan.Agent" with 75% detection rate) 18/23 Antivirus vendors marked spawned process "QEQ.exe" (PID: 2864) as malicious (classified as "Trojan.Agent" with 78% detection rate) 19/27 Antivirus vendors marked spawned process "LYVXACA.exe" (PID: 5352) as malicious (classified as "Agent" with 70% detection rate) 18/24 Antivirus vendors marked spawned process "OMZLOC.exe" (PID: 940) as malicious (classified as "Trojan.Agent" with 75% detection rate) 19/27 Antivirus vendors marked spawned process "PQLZSP.exe" (PID: 4700) as malicious (classified as "Trojan.Agent" with 70% detection rate) 18/26 Antivirus vendors marked spawned process "RBFFNT.exe" (PID: 5596) as malicious (classified as "Trojan.Agent" with 69% detection rate) 18/26 Antivirus vendors marked spawned process "NVE.exe" (PID: 2392) as malicious (classified as "Trojan.Agent" with 69% detection rate) 18/26 Antivirus vendors marked spawned process "FLX.exe" (PID: 4352) as malicious (classified as "Trojan.Agent" with 69% detection rate)8c:T987,File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\System\HQJQFTK.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\SysWOW64\RBFFNT.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\VFFNFTJ.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\LYVXACA.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\System\FLX.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\PQLZSP.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\RSFO.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\System\MVJOU.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\OUQBA.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\SysWOW64\YAU.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\OMZLOC.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\System\SHLSGCM.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\QEQ.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\NTKA.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\NVE.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\RCP.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\SUL.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\System\JOYJ.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\TTCMDR.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\SysWOW64\QWNAL.exe" File type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 4 sections" was dropped at "%WINDIR%\System\HNHWPQB.exe"8d:T801,"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: b84 "NTKA.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 171c "SHLSGCM.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 1c18 "HQJQFTK.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: af0 "OUQBA.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 1b44 "YAU.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 45c "QWNAL.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 1f34 "VFFNFTJ.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 1ea4 "TTCMDR.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: db0 "RSFO.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 1e48 "JOYJ.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 9e4 "RCP.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 600 "HNHWPQB.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 1ba4 "SUL.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 1cfc "MVJOU.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 1b10 "QEQ.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: b30 "LYVXACA.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 14e8 "OMZLOC.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 3ac "PQLZSP.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 125c "RBFFNT.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 15dc "NVE.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 958 "FLX.exe" sets a callback procedure (408e87) using filter "WH_CBT" for process ID: 11008e:T1201,"cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\NTKA.exe" (Handle: 444) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\NTKA.exe" (Handle: 444) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\NTKA.exe" (Handle: 444) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System\SHLSGCM.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\System\SHLSGCM.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\System\SHLSGCM.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System\HQJQFTK.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\System\HQJQFTK.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\System\HQJQFTK.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\OUQBA.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\OUQBA.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\OUQBA.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\SysWOW64\YAU.exe" (Handle: 432) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\YAU.exe" (Handle: 432) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\YAU.exe" (Handle: 432) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\SysWOW64\QWNAL.exe" (Handle: 432) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\QWNAL.exe" (Handle: 432) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\QWNAL.exe" (Handle: 432) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\VFFNFTJ.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\VFFNFTJ.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\VFFNFTJ.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\TTCMDR.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\TTCMDR.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\TTCMDR.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\RSFO.exe" (Handle: 432) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\RSFO.exe" (Handle: 432) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\RSFO.exe" (Handle: 432) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System\JOYJ.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\System\JOYJ.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\System\JOYJ.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\RCP.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\RCP.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\RCP.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System\HNHWPQB.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\System\HNHWPQB.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\System\HNHWPQB.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\SUL.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\SUL.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\SUL.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System\MVJOU.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\System\MVJOU.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\System\MVJOU.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\QEQ.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\QEQ.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\QEQ.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\LYVXACA.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\LYVXACA.exe" (Handle: 436) "cmd.exe" wrote 00000004 bytes to a remote process "C:\Windows\LYVXACA.exe" (Handle: 436) "cmd.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\OMZLOC.exe" (Handle: 436) "cmd.exe" wrote 00000008 bytes to a remote process "C:\Windows\OMZLOC.exe" (Handle: 436)8f:T107a,Spawned process "9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe" (UID: 00000000-00002948) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\NTKA.exe.bat" "" (UID: 00000000-00003124) Spawned process "NTKA.exe" (UID: 00000000-00005916) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\SHLSGCM.exe.bat" "" (UID: 00000000-00003216) Spawned process "SHLSGCM.exe" (UID: 00000000-00007192) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\HQJQFTK.exe.bat" "" (UID: 00000000-00007336) Spawned process "HQJQFTK.exe" (UID: 00000000-00002800) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\OUQBA.exe.bat" "" (UID: 00000000-00007324) Spawned process "OUQBA.exe" (UID: 00000000-00006980) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system32\\YAU.exe.bat" "" (UID: 00000000-00006108) Spawned process "YAU.exe" with commandline "%WINDIR%\\system32\\YAU.exe" (UID: 00000000-00001116) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system32\\QWNAL.exe.bat" "" (UID: 00000000-00006120) Spawned process "QWNAL.exe" with commandline "%WINDIR%\\system32\\QWNAL.exe" (UID: 00000000-00007988) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\VFFNFTJ.exe.bat" "" (UID: 00000000-00007840) Spawned process "VFFNFTJ.exe" (UID: 00000000-00007844) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\TTCMDR.exe.bat" "" (UID: 00000000-00007528) Spawned process "TTCMDR.exe" (UID: 00000000-00003504) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\RSFO.exe.bat" "" (UID: 00000000-00000868) Spawned process "RSFO.exe" (UID: 00000000-00007752) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\JOYJ.exe.bat" "" (UID: 00000000-00006996) Spawned process "JOYJ.exe" (UID: 00000000-00002532) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\RCP.exe.bat" "" (UID: 00000000-00001632) Spawned process "RCP.exe" (UID: 00000000-00001536) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\HNHWPQB.exe.bat" "" (UID: 00000000-00003628) Spawned process "HNHWPQB.exe" (UID: 00000000-00007076) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\SUL.exe.bat" "" (UID: 00000000-00003648) Spawned process "SUL.exe" (UID: 00000000-00007420) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\MVJOU.exe.bat" "" (UID: 00000000-00004704) Spawned process "MVJOU.exe" (UID: 00000000-00006928) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\QEQ.exe.bat" "" (UID: 00000000-00005764) Spawned process "QEQ.exe" (UID: 00000000-00002864) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\LYVXACA.exe.bat" "" (UID: 00000000-00007220) Spawned process "LYVXACA.exe" (UID: 00000000-00005352) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\OMZLOC.exe.bat" "" (UID: 00000000-00007308) Spawned process "OMZLOC.exe" (UID: 00000000-00000940) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\PQLZSP.exe.bat" "" (UID: 00000000-00004816) Spawned process "PQLZSP.exe" (UID: 00000000-00004700) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system32\\RBFFNT.exe.bat" "" (UID: 00000000-00005556) Spawned process "RBFFNT.exe" with commandline "%WINDIR%\\system32\\RBFFNT.exe" (UID: 00000000-00005596) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\NVE.exe.bat" "" (UID: 00000000-00004344) Spawned process "NVE.exe" (UID: 00000000-00002392) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%WINDIR%\\system\\FLX.exe.bat" "" (UID: 00000000-00003264) Spawned process "FLX.exe" (UID: 00000000-00004352)90:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==91:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==92:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==93:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==94:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==95:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==96:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==97:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==98:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==99:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==9a:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==9b:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==9c:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==9d:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==9e:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==9f:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==a0:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==a1:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==a2:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==a3:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==a4:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==a5:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==a6:T400,AAABAAEAICAQkwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAdwAAAAAAAAAAAHcAAAd3dwd3AAAAAAAAAHcHAAD//3dwd3AAAHdwAAd3B3AA8AAAcHd3AAAAdwD/9wd3Dwd3dwcHdwAHcHdw//dwdw8H9/cHB3dwD3cAcAAP9wD393d38HB3cAf3cAAAAP9w93AAB3Bwd3B3//AAAAAHcHB3/3AAcHcHfwAAAAAAAAcH///4hwcAd3AAAAAAAAAAeIcHB4hwB3cHAAAAAAAAB4j3BweIhwBwdwAAAAAACI//9wAH//h3B3cAAAAAAAj3ER9wfxEX9wd3AAAAAAAH8ZmR93GZkXcHcAAAAAAAAPGZkXdxmZFwd3AAAAAAAABxmZF3cZmRcHd3AAAAAAAAdxEYiIgRF3AHdwAAAAAAB/+IiIiP+Id3B3cAAAAAAAd////4iP//dwd3AAAAAAAHd3///4iId3cHdwAAAAAAB4iP///4iId3B3AAAAAAAAeIj////4iHdwB3AAAAAAAAiI/////4iHB3B3AAAAAAAHiP////+Ihwd3B3AAAAAPcHj/////+HAA93B3dwAA93AAj////3AAAA93AAcP93cAAAAAAAAAAAAA+HdwD/dwAAAAAAAAAAAAAA/4cAD/cAAAAAAAAAAAAAAP/wAAD3AAAAAAAAAAAAAAD/AAD/////w/8///PgD//DwAfHgcACAwAAAAEAAAAN4AAAB/AAAAf4AAA//gAAf/8AAD/+AAA/+AAAP/gAAD/4AAB//AAAf/wAAD/8AAA/+AAAP/gAAD/4AAA/+AAAf/gAAD/8AAQf/AAED/IADgHjgD8BB///gw///8OP///Hz///zw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791045518070,"unified_at":"2026-10-03T16:38:38.070Z","metadata":{"hashes":{"sha256":"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","sha1":"13c899a0ed18cafdfc79e46f90cf4312e7191319","md5":"7fb39496ac3756ae12d9721222819771","sha512":"2e0a5721a95cadb291aad57af776141af5827c86571762c123182f4f43c6b9551b9348f0e2f2fb46b08efaaf81cdbfc9dda0d442fd89102612b1380bd12c56e0","ssdeep":"3072:HDwzIx/UgnXAOu2BC+NtVIc/UAQz3sN3k5DKHceNgnoPSP4pLthEjQT6j:GCJXrJBC+NtV9HN3sK8eNgnYSPkEj1","ssdeep_chunks":["3072:HDwzIx/","3072:DwzIx/U","3072:wzIx/Ug","3072:zIx/Ugn","3072:Ix/UgnX","3072:x/UgnXA","3072:/UgnXAO","3072:UgnXAOu","3072:gnXAOu2","3072:nXAOu2B","3072:XAOu2BC","3072:AOu2BC+","3072:Ou2BC+N","3072:u2BC+Nt","3072:2BC+NtV","3072:BC+NtVI","3072:C+NtVIc","3072:+NtVIc/","3072:NtVIc/U","3072:tVIc/UA","3072:VIc/UAQ","3072:Ic/UAQz","3072:c/UAQz3","3072:/UAQz3s","3072:UAQz3sN","3072:AQz3sN3","3072:Qz3sN3k","3072:z3sN3k5","3072:3sN3k5D","3072:sN3k5DK","3072:N3k5DKH","3072:3k5DKHc","3072:k5DKHce","3072:5DKHceN","3072:DKHceNg","3072:KHceNgn","3072:HceNgno","3072:ceNgnoP","3072:eNgnoPS","3072:NgnoPSP","3072:gnoPSP4","3072:noPSP4p","3072:oPSP4pL","3072:PSP4pLt","3072:SP4pLth","3072:P4pLthE","3072:4pLthEj","3072:pLthEjQ","3072:LthEjQT","3072:thEjQT6","3072:hEjQT6j","6144:HDwzIx/","6144:DwzIx/U","6144:wzIx/Ug","6144:zIx/Ugn","6144:Ix/UgnX","6144:x/UgnXA","6144:/UgnXAO","6144:UgnXAOu","6144:gnXAOu2","6144:nXAOu2B","6144:XAOu2BC","6144:AOu2BC+","6144:Ou2BC+N","6144:u2BC+Nt","6144:2BC+NtV","6144:BC+NtVI","6144:C+NtVIc","6144:+NtVIc/","6144:NtVIc/U","6144:tVIc/UA","6144:VIc/UAQ","6144:Ic/UAQz","6144:c/UAQz3","6144:/UAQz3s","6144:UAQz3sN","6144:AQz3sN3","6144:Qz3sN3k","6144:z3sN3k5","6144:3sN3k5D","6144:sN3k5DK","6144:N3k5DKH","6144:3k5DKHc","6144:k5DKHce","6144:5DKHceN","6144:DKHceNg","6144:KHceNgn","6144:HceNgno","6144:ceNgnoP","6144:eNgnoPS","6144:NgnoPSP","6144:gnoPSP4","6144:noPSP4p","6144:oPSP4pL","6144:PSP4pLt","6144:SP4pLth","6144:P4pLthE","6144:4pLthEj","6144:pLthEjQ","6144:LthEjQT","6144:thEjQT6","6144:hEjQT6j","3072:GCJXrJB","3072:CJXrJBC","3072:JXrJBC+","3072:XrJBC+N","3072:rJBC+Nt","3072:JBC+NtV","3072:BC+NtV9","3072:C+NtV9H","3072:+NtV9HN","3072:NtV9HN3","3072:tV9HN3s","3072:V9HN3sK","3072:9HN3sK8","3072:HN3sK8e","3072:N3sK8eN","3072:3sK8eNg","3072:sK8eNgn","3072:K8eNgnY","3072:8eNgnYS","3072:eNgnYSP","3072:NgnYSPk","3072:gnYSPkE","3072:nYSPkEj","3072:YSPkEj1"],"imphash":"03ae0108c7455c49c94d2d60afa1e57a"},"file_info":{"file_name":"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","file_type":["peexe","executable"],"file_type_id":"exe","file_size":212992,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791044977000,"last_seen":1791045123000,"last_multi_scan":1791045123000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["aenjaris","evasive"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":61},"sandbox_signatures":{"informative_count":148,"suspicious_count":12,"malicious_count":10,"total":170},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Aenjaris","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.ZPACK.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CQST","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Razy-9759519-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.CQST (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.WTK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Agent.uh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ac2dd1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_reference_anti_VM_strings","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-AOHK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Nobady.pef","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-FKME!7FB39496AC37","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/S-6053bf39!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.AgentT.DYW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Aenjaris.ABC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.AgentGen.Win32.95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Creates multiple processes"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Double File Extension","attack_id":"T1036.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/007","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a computer-based training (CBT) hook"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to lookup its own filename"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to lookup its own filename","description":"PathFindFileNameA@SHLWAPI.DLL at 00000000-00002800-4663-574-0040CEA6\n PathFindFileNameA@SHLWAPI.DLL at 00000000-00007988-8392-573-0040CEA6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":5,"id":"stream-65","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00001116.00000000.268389.00C01000.00000004.mdmp\n Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00001536.00000000.269334.00801000.00000004.mdmp\n Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00002392.00000000.270848.00801000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"$2b","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"cmd.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cmd.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"NTKA.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"NTKA.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2d","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"$2e","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002800-4663-40-0041362B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002800-4663-41-0040E454\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002800-4663-623-0041953E\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007988-8392-40-0041362B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007988-8392-41-0040E454\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007988-8392-622-0041953E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API InitializeCriticalSectionAndSpinCount@KERNEL32.DLL at 00000000-00002800-4663-57-00416F16\n Found reference to API NtResumeProcess@NTDLL.DLL at 00000000-00002800-4663-260-00422822\n Found reference to API NotifyWinEvent@USER32.DLL at 00000000-00002800-4663-850-0040D063\n Found reference to API InitializeCriticalSectionAndSpinCount@KERNEL32.DLL at 00000000-00007988-8392-57-00416F16\n Found reference to API NtResumeProcess@NTDLL.DLL at 00000000-00007988-8392-260-00422822\n Found reference to API NotifyWinEvent@USER32.DLL at 00000000-00007988-8392-849-0040D063","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000940.00000000.270374.034A0000.00000004.mdmp\")\n Found string \":\\windows\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001116.00000000.268389.02DE0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001536.00000000.269334.02C80000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002392.00000000.270848.02A30000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002532.00000000.269175.03340000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002800.00000000.268071.03500000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002948-00000C2C-3170032989\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"$36","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00002948)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" called \"GetMonitorInfoA\" with parameters (UID: 00000000-00002948)\n \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002948)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Calls APIs used for find file/directory path","description":"$37","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-183","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002948)\n \"NTKA.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005916)\n \"SHLSGCM.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007192)\n \"HQJQFTK.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002800)\n \"OUQBA.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006980)\n \"YAU.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001116)\n \"QWNAL.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007988)\n \"VFFNFTJ.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007844)\n \"TTCMDR.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003504)\n \"RSFO.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007752)\n \"JOYJ.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002532)\n \"RCP.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001536)\n \"HNHWPQB.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007076)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"FLX.exe\" called \"GetActiveWindow\" (UID: 00000000-00004352)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002948)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$38","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00002948)\n \"NTKA.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005916)\n \"SHLSGCM.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007192)\n \"HQJQFTK.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00002800)\n \"OUQBA.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00006980)\n \"YAU.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00001116)\n \"QWNAL.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007988)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002800-4663-249-00422AA0\n GetTickCount@KERNEL32.DLL at 00000000-00002800-4663-645-00415DDA\n GetTickCount@KERNEL32.DLL at 00000000-00007988-8392-249-00422AA0\n GetTickCount@KERNEL32.DLL at 00000000-00007988-8392-644-00415DDA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00002800-4663-247-00422990\n FindFirstFileA@KERNEL32.DLL at 00000000-00007988-8392-247-00422990","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002800-4663-245-0040EA66\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002800-4663-645-00415DDA\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007988-8392-245-0040EA66\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007988-8392-644-00415DDA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002800-4663-245-0040EA66\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002800-4663-645-00415DDA\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007988-8392-245-0040EA66\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007988-8392-644-00415DDA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00000000-00002800-4663-396-0040519C\n GetVersion@KERNEL32.DLL at 00000000-00002800-4663-416-0040203B\n GetVersionExA@KERNEL32.DLL at 00000000-00002800-4663-687-00420E81\n GetVersion@KERNEL32.DLL at 00000000-00002800-4663-824-0040C073\n GetVersionExA@KERNEL32.DLL at 00000000-00002800-4663-843-0040F03D\n GetVersionExA@KERNEL32.DLL at 00000000-00002800-4663-1087-0042107B\n GetVersionExA@KERNEL32.DLL at 00000000-00007988-8392-395-0040519C\n GetVersion@KERNEL32.DLL at 00000000-00007988-8392-415-0040203B\n GetVersionExA@KERNEL32.DLL at 00000000-00007988-8392-686-00420E81\n GetVersion@KERNEL32.DLL at 00000000-00007988-8392-823-0040C073\n GetVersionExA@KERNEL32.DLL at 00000000-00007988-8392-842-0040F03D\n GetVersionExA@KERNEL32.DLL at 00000000-00007988-8392-1086-0042107B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00002800-4663-195-0041EAD7\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002800-4663-410-00401CED\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00002800-4663-686-00420E18\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00007988-8392-195-0041EAD7\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00007988-8392-409-00401CED\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00007988-8392-685-00420E18","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00002800-4663-210-0041E03B\n OpenProcess@KERNEL32.DLL at 00000000-00002800-4663-258-00422940\n OpenProcess@KERNEL32.DLL at 00000000-00002800-4663-697-00423060\n GetProcessHeap@KERNEL32.DLL at 00000000-00007988-8392-210-0041E03B\n OpenProcess@KERNEL32.DLL at 00000000-00007988-8392-258-00422940\n OpenProcess@KERNEL32.DLL at 00000000-00007988-8392-696-00423060","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000088h], 02h\" and \"xor ecx, ebp\" at 00000000-00002800-4663-396-0040519C\n Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000088h], 02h\" and \"jne 00420EC2h\" at 00000000-00002800-4663-687-00420E81\n Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-10h], 02h\" and \"jne 004210DFh\" at 00000000-00002800-4663-1087-0042107B\n Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000088h], 02h\" and \"xor ecx, ebp\" at 00000000-00007988-8392-395-0040519C\n Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00000088h], 02h\" and \"jne 00420EC2h\" at 00000000-00007988-8392-686-00420E81\n Found API call GetVersionExA@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-10h], 02h\" and \"jne 004210DFh\" at 00000000-00007988-8392-1086-0042107B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"$40","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\")\n Found reference to API \"GrayStringA\" (Indicator: \"GrayStringA\"; Source: \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\"\n Report process \"WerFault.exe\" was created by \"NTKA.exe\"\n Report process \"WerFault.exe\" was created by \"SHLSGCM.exe\"\n Report process \"WerFault.exe\" was created by \"HQJQFTK.exe\"\n Report process \"WerFault.exe\" was created by \"OUQBA.exe\"\n Report process \"WerFault.exe\" was created by \"YAU.exe\"\n Report process \"WerFault.exe\" was created by \"QWNAL.exe\"\n Report process \"WerFault.exe\" was created by \"VFFNFTJ.exe\"\n Report process \"WerFault.exe\" was created by \"TTCMDR.exe\"\n Report process \"WerFault.exe\" was created by \"RSFO.exe\"\n Report process \"WerFault.exe\" was created by \"JOYJ.exe\"\n Report process \"WerFault.exe\" was created by \"RCP.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$42","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00002800-4663-59-00412861\n Sleep@KERNEL32.DLL at 00000000-00002800-4663-65-004128A1\n Sleep@KERNEL32.DLL at 00000000-00002800-4663-93-004128E9\n Sleep@KERNEL32.DLL at 00000000-00002800-4663-259-004228A0\n SetTimer at 00000000-00002800-4663-261-00401210\n Sleep@KERNEL32.DLL at 00000000-00002800-4663-962-00412934\n Sleep@KERNEL32.DLL at 00000000-00007988-8392-59-00412861\n Sleep@KERNEL32.DLL at 00000000-00007988-8392-65-004128A1\n Sleep@KERNEL32.DLL at 00000000-00007988-8392-93-004128E9\n Sleep@KERNEL32.DLL at 00000000-00007988-8392-259-004228A0\n SetTimer at 00000000-00007988-8392-261-00401210\n Sleep@KERNEL32.DLL at 00000000-00007988-8392-961-00412934","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"$44","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002800-4663-39-0041C594\n LoadLibraryA@KERNEL32.DLL at 00000000-00002800-4663-357-004073B1\n LoadLibraryA@KERNEL32.DLL at 00000000-00002800-4663-410-00401CED\n LoadLibraryA@KERNEL32.DLL at 00000000-00002800-4663-688-00421173\n LoadLibraryA@KERNEL32.DLL at 00000000-00002800-4663-759-00406250\n LoadLibraryA@KERNEL32.DLL at 00000000-00007988-8392-39-0041C594\n LoadLibraryA@KERNEL32.DLL at 00000000-00007988-8392-356-004073B1\n LoadLibraryA@KERNEL32.DLL at 00000000-00007988-8392-409-00401CED\n LoadLibraryA@KERNEL32.DLL at 00000000-00007988-8392-687-00421173\n LoadLibraryA@KERNEL32.DLL at 00000000-00007988-8392-758-00406250","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"$46","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Creates multiple processes","description":"\"QEQ.exe\" created multiple process\n \"cmd.exe\" created multiple process\n \"WerFault.exe\" created multiple process\n \"LYVXACA.exe\" created multiple process\n \"OMZLOC.exe\" created multiple process\n \"PQLZSP.exe\" created multiple process\n \"RBFFNT.exe\" created multiple process\n \"NVE.exe\" created multiple process\n \"FLX.exe\" created multiple process","origin":"Monitored Target","mitre_attack_id":"T1106","relevance":1,"id":"target-719","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4d","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$4e","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"$4f","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$50","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$51","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$52","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$53","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"$54","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$55","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$56","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"$57","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$58","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$59","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$5a","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00003124) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cmd.exe\" (UID: 00000000-00003124) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$5b","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"$5d","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$5e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$5f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"$60","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"NTKA.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"SHLSGCM.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"HQJQFTK.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"OUQBA.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"YAU.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"QWNAL.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"VFFNFTJ.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"TTCMDR.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"RSFO.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"JOYJ.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"RCP.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"HNHWPQB.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"OUQBA.exe\" create file \"C:\\Windows\\SysWOW64\\YAU.exe\"\n \"OUQBA.exe\" create file \"C:\\Windows\\SysWOW64\\YAU.exe.bat\"\n \"OUQBA.exe\" create file \"%WINDIR%\\SysWOW64\\YAU.exe\"\n \"OUQBA.exe\" create file \"%WINDIR%\\SysWOW64\\YAU.exe.bat\"\n \"YAU.exe\" create file \"C:\\Windows\\SysWOW64\\QWNAL.exe\"\n \"YAU.exe\" create file \"C:\\Windows\\SysWOW64\\QWNAL.exe.bat\"\n \"YAU.exe\" create file \"%WINDIR%\\SysWOW64\\QWNAL.exe\"\n \"YAU.exe\" create file \"%WINDIR%\\SysWOW64\\QWNAL.exe.bat\"\n \"PQLZSP.exe\" create file \"C:\\Windows\\SysWOW64\\RBFFNT.exe\"\n \"PQLZSP.exe\" create file \"C:\\Windows\\SysWOW64\\RBFFNT.exe.bat\"\n \"PQLZSP.exe\" create file \"%WINDIR%\\SysWOW64\\RBFFNT.exe\"\n \"PQLZSP.exe\" create file \"%WINDIR%\\SysWOW64\\RBFFNT.exe.bat\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$61","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$62","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$63","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$64","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$65","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$66","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$67","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$68","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$69","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" writes file \"c:\\windows\\ntka.exe\"\n \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" writes file \"c:\\windows\\ntka.exe.bat\"\n \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" writes file \"%windir%\\ntka.exe\"\n \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" writes file \"%windir%\\ntka.exe.bat\"\n \"NTKA.exe\" writes file \"c:\\windows\\system\\shlsgcm.exe\"\n \"NTKA.exe\" writes file \"c:\\windows\\system\\shlsgcm.exe.bat\"\n \"NTKA.exe\" writes file \"%windir%\\system\\shlsgcm.exe\"\n \"NTKA.exe\" writes file \"%windir%\\system\\shlsgcm.exe.bat\"\n \"SHLSGCM.exe\" writes file \"c:\\windows\\system\\hqjqftk.exe\"\n \"SHLSGCM.exe\" writes file \"c:\\windows\\system\\hqjqftk.exe.bat\"\n \"SHLSGCM.exe\" writes file \"%windir%\\system\\hqjqftk.exe\"\n \"SHLSGCM.exe\" writes file \"%windir%\\system\\hqjqftk.exe.bat\"\n \"HQJQFTK.exe\" writes file \"c:\\windows\\ouqba.exe\"\n \"HQJQFTK.exe\" writes file \"c:\\windows\\ouqba.exe.bat\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.1\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"cp.ocpn/p\\tppplc`~cppz,;ppp\"\n Pattern match: \"www.rqir:y.rjy.bca.0ci.vjp2qkkkh+qhcwinappsettingspreviewpagesdeactivateactctxactivateactctxreleaseactctxcreateactctxakernel32software\\microsoft\\windows\\currentversion\\policies\\explorernorunnodrivesrestrictrunnonetconnectdisconnectnorecentdocshistorynoclos\"\n Pattern match: \"eu.qqqp/f-oqqqqq^fpqqe[qqqvm\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"\n Heuristic match: \"pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.ws\"\n Heuristic match: \"bat;.cm\"\n Heuristic match: \"rcpexe~1.ba\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"$6c","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$6f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"$70","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"HQJQFTK.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"VFFNFTJ.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"LYVXACA.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"RSFO.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"MVJOU.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"OUQBA.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"OMZLOC.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"RCP.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"SUL.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"JOYJ.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"TTCMDR.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"$71","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$72","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$73","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$74","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$75","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"$76","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$77","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$78","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"$79","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in file \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"$7a","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000940.00000000.270374.034A0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001116.00000000.268389.02DE0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001536.00000000.269334.02C80000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002392.00000000.270848.02A30000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002532.00000000.269175.03340000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002800.00000000.268071.03500000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00000940.00000000.270374.056B0000.00000004.mdmp\n Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00001116.00000000.268389.05170000.00000004.mdmp\n Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00001536.00000000.269334.04770000.00000004.mdmp\n Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00002392.00000000.270848.04560000.00000004.mdmp\n Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00002532.00000000.269175.057C0000.00000004.mdmp\n Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00002800.00000000.268071.05780000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$7b","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"$7c","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$7d","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000940.00000000.270374.056C0000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001116.00000000.268389.05000000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00001536.00000000.269334.04D80000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002392.00000000.270848.04C60000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002532.00000000.269175.056B0000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002800.00000000.268071.00425000.00000002.mdmp, 00000000-00002800.00000000.268071.05AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe\" opened \"\\Device\\KsecDD\"\n \"NTKA.exe\" opened \"\\Device\\KsecDD\"\n \"SHLSGCM.exe\" opened \"\\Device\\KsecDD\"\n \"HQJQFTK.exe\" opened \"\\Device\\KsecDD\"\n \"OUQBA.exe\" opened \"\\Device\\KsecDD\"\n \"YAU.exe\" opened \"\\Device\\KsecDD\"\n \"QWNAL.exe\" opened \"\\Device\\KsecDD\"\n \"VFFNFTJ.exe\" opened \"\\Device\\KsecDD\"\n \"TTCMDR.exe\" opened \"\\Device\\KsecDD\"\n \"RSFO.exe\" opened \"\\Device\\KsecDD\"\n \"JOYJ.exe\" opened \"\\Device\\KsecDD\"\n \"RCP.exe\" opened \"\\Device\\KsecDD\"\n \"HNHWPQB.exe\" opened \"\\Device\\KsecDD\"\n \"SUL.exe\" opened \"\\Device\\KsecDD\"\n \"MVJOU.exe\" opened \"\\Device\\KsecDD\"\n \"QEQ.exe\" opened \"\\Device\\KsecDD\"\n \"LYVXACA.exe\" opened \"\\Device\\KsecDD\"\n \"OMZLOC.exe\" opened \"\\Device\\KsecDD\"\n \"PQLZSP.exe\" opened \"\\Device\\KsecDD\"\n \"RBFFNT.exe\" opened \"\\Device\\KsecDD\"\n \"NVE.exe\" opened \"\\Device\\KsecDD\"\n \"FLX.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$7e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$7f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$80","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$81","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"$82","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"19/27 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00002800-4663-315-00403206\n LockResource@KERNEL32.DLL at 00000000-00002800-4663-316-004031CD\n LoadResource@KERNEL32.DLL at 00000000-00002800-4663-409-00401B87\n FindResourceA@KERNEL32.DLL at 00000000-00002800-4663-428-00401BE3\n FindResourceA@KERNEL32.DLL at 00000000-00002800-4663-443-00402CF2\n FindResourceA@KERNEL32.DLL at 00000000-00002800-4663-692-0040A1F7\n FindResourceA@KERNEL32.DLL at 00000000-00002800-4663-700-00402FDF\n FindResourceA@KERNEL32.DLL at 00000000-00007988-8392-314-00403206\n LockResource@KERNEL32.DLL at 00000000-00007988-8392-315-004031CD\n LoadResource@KERNEL32.DLL at 00000000-00007988-8392-408-00401B87\n FindResourceA@KERNEL32.DLL at 00000000-00007988-8392-427-00401BE3\n FindResourceA@KERNEL32.DLL at 00000000-00007988-8392-442-00402CF2\n FindResourceA@KERNEL32.DLL at 00000000-00007988-8392-691-0040A1F7\n FindResourceA@KERNEL32.DLL at 00000000-00007988-8392-699-00402FDF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$83","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$84","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$85","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00002800-4663-394-004053A0\n SystemParametersInfoA@USER32.DLL at 00000000-00007988-8392-393-004053A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$86","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$87","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"$88","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtResumeProcess@NTDLL.DLL at 00000000-00002800-4663-260-00422822\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00002800-4663-459-00405ABC\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00002800-4663-484-00407D53\n NtResumeProcess@NTDLL.DLL at 00000000-00007988-8392-260-00422822\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007988-8392-458-00405ABC\n NtdllDefWindowProc_A@NTDLL.DLL at 00000000-00007988-8392-483-00407D53","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegOpenKeyA\n RegEnumKeyA\n RegCloseKey\n RegOpenKeyExA\n RegCreateKeyExA\n GetCommandLineA\n WriteFile\n IsDebuggerPresent\n OpenProcess\n TerminateProcess\n Sleep\n FindResourceA\n FindFirstFileA\n LockResource\n CreateFileA\n GetModuleHandleA\n LoadLibraryA\n VirtualAlloc\n GetStartupInfoA\n GetTickCount\n GetModuleFileNameA\n GetFileSize\n UnhandledExceptionFilter\n CopyFileA\n GetVersionExA\n GetProcAddress\n GetModuleFileNameW\n GetModuleFileNameExA\n EnumProcesses\n ShellExecuteA\n GetCursorPos\n GetLastActivePopup\n GetWindowThreadProcessId\n SetWindowsHookExA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"$89","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"19/27 Antivirus vendors marked sample as malicious (70% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 3)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$8a","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$8b","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"$8c","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"$8d","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$8e","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$8f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]}],"intel_graph":{"map":{"File:00a7585f20162fb56ad93913434b27c850baa207e3e3343f2076353a9f776a1e":{"type":"File","value":"00a7585f20162fb56ad93913434b27c850baa207e3e3343f2076353a9f776a1e"},"File:047b34d0aaa61a5280ad1d02bdc38b427ed0f14971ea5b4af06d12d33ca1e757":{"type":"File","value":"047b34d0aaa61a5280ad1d02bdc38b427ed0f14971ea5b4af06d12d33ca1e757"},"File:0de35c68144a0dd99f2cd149165372148fa8b569d114d52b7c08f409b4deb7fb":{"type":"File","value":"0de35c68144a0dd99f2cd149165372148fa8b569d114d52b7c08f409b4deb7fb"},"File:192992ff6989f3efdcbaa752fb07f86a8b075f3c46b70915c3d01f727a2901ae":{"type":"File","value":"192992ff6989f3efdcbaa752fb07f86a8b075f3c46b70915c3d01f727a2901ae"},"File:206148e46fd0a8c08746b3ebd3f15d6659d1346fbd12a068790c119f68c7b3e8":{"type":"File","value":"206148e46fd0a8c08746b3ebd3f15d6659d1346fbd12a068790c119f68c7b3e8"},"File:21eb820233cea96405a891cc02b45b644963992c09df634b93cc4a612f765627":{"type":"File","value":"21eb820233cea96405a891cc02b45b644963992c09df634b93cc4a612f765627"},"File:21f671ecef25e5b5ec23fd24c14cac55d345ef09d790f9eb5a552703a82bf08a":{"type":"File","value":"21f671ecef25e5b5ec23fd24c14cac55d345ef09d790f9eb5a552703a82bf08a"},"File:2a75ddf7ae40a6e0d8c3e8ba25346558a608d13d910e7693b0eb2966ecdf7fa1":{"type":"File","value":"2a75ddf7ae40a6e0d8c3e8ba25346558a608d13d910e7693b0eb2966ecdf7fa1"},"File:33f3a633364d082f149c6dc7ee8a90bf93ebbf3fa0bca8b75f2d01263e5e5320":{"type":"File","value":"33f3a633364d082f149c6dc7ee8a90bf93ebbf3fa0bca8b75f2d01263e5e5320"},"File:345be9f7f60c82dfd70d64e90d0f8e727c9e8f542e61695f1936212416d08598":{"type":"File","value":"345be9f7f60c82dfd70d64e90d0f8e727c9e8f542e61695f1936212416d08598"},"File:38d9be401294b095c582705ed98ff5680f2dae7770df11d3c712552dc944e4f7":{"type":"File","value":"38d9be401294b095c582705ed98ff5680f2dae7770df11d3c712552dc944e4f7"},"File:42c1e7838c4983e06a07f0161677f3028eebb23d7bd084a539fa4dca9d667be8":{"type":"File","value":"42c1e7838c4983e06a07f0161677f3028eebb23d7bd084a539fa4dca9d667be8"},"File:438000ce1065551724d3513670aad771603de5ef6d403c53dcfb1a59e6aef9f9":{"type":"File","value":"438000ce1065551724d3513670aad771603de5ef6d403c53dcfb1a59e6aef9f9"},"File:58f3267670dc085fa4d980d6c1d0a7476fbca60d25366728d1cdb60fde6e3ff0":{"type":"File","value":"58f3267670dc085fa4d980d6c1d0a7476fbca60d25366728d1cdb60fde6e3ff0"},"File:6354fa2c299b3cac72fe7bb8c13a79fbbaf1d87fbf733867d4dde079261c6b70":{"type":"File","value":"6354fa2c299b3cac72fe7bb8c13a79fbbaf1d87fbf733867d4dde079261c6b70"},"File:65020dc9ad4971088d9bbabb88220c21c00c4a69462e20aea2bdac1178b77b83":{"type":"File","value":"65020dc9ad4971088d9bbabb88220c21c00c4a69462e20aea2bdac1178b77b83"},"File:654239b2e5cf565fc632dd6c22ad0fad83e7639ff335ec4e9e67e5276a420679":{"type":"File","value":"654239b2e5cf565fc632dd6c22ad0fad83e7639ff335ec4e9e67e5276a420679"},"File:6a51233d42dd5a9dffb7c3f868c8886aba28568e57f1775f5bdbff9156b80344":{"type":"File","value":"6a51233d42dd5a9dffb7c3f868c8886aba28568e57f1775f5bdbff9156b80344"},"File:6dd4886a473e515a543ebc9705e63742744aac3de65ec5dc5d9881f6eacc1b8e":{"type":"File","value":"6dd4886a473e515a543ebc9705e63742744aac3de65ec5dc5d9881f6eacc1b8e"},"File:716616214afc8fedf11ed6c35313fafde5d879a47ab386adbf30df051be4ef22":{"type":"File","value":"716616214afc8fedf11ed6c35313fafde5d879a47ab386adbf30df051be4ef22"},"File:76a5d2ae6520f82e0e363f449102ecec9a8de4895048d8de19324fc134f72784":{"type":"File","value":"76a5d2ae6520f82e0e363f449102ecec9a8de4895048d8de19324fc134f72784"},"File:776377768e9df7cde2e702267d4e4e2084ca13cf42de3ef3a1cad0c7a00db63e":{"type":"File","value":"776377768e9df7cde2e702267d4e4e2084ca13cf42de3ef3a1cad0c7a00db63e"},"File:87e8fbb0f00ab3d2d354ae9b454a5df3fd88f994deb0bfe6a05358cb33083a6e":{"type":"File","value":"87e8fbb0f00ab3d2d354ae9b454a5df3fd88f994deb0bfe6a05358cb33083a6e"},"File:88bb2503f047c481badd93cf9fc854d2bf29c0bdca460acfe9ec827dbae83b4e":{"type":"File","value":"88bb2503f047c481badd93cf9fc854d2bf29c0bdca460acfe9ec827dbae83b4e"},"File:8c840edaf753711e9dea0a2244011232bc746205f93445c035acdcdbdc9da471":{"type":"File","value":"8c840edaf753711e9dea0a2244011232bc746205f93445c035acdcdbdc9da471"},"File:9190a646a6b5cd1c749044f22f42c8d9d301e97ab2a7abfd3b138d2d1216904c":{"type":"File","value":"9190a646a6b5cd1c749044f22f42c8d9d301e97ab2a7abfd3b138d2d1216904c"},"File:956f608f1ea7560f2ec9180a5a61e4c9c1ce1bbdc592766f300c283a7c87ecc8":{"type":"File","value":"956f608f1ea7560f2ec9180a5a61e4c9c1ce1bbdc592766f300c283a7c87ecc8"},"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757":{"type":"File","value":"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757"},"File:a05692a4c12d23406e3ac61418927e31c7f11410406bb95decfb89bc127df5cd":{"type":"File","value":"a05692a4c12d23406e3ac61418927e31c7f11410406bb95decfb89bc127df5cd"},"File:a1d3b65c429beb3a2ccaa966b99b42a99d50b157370aadea09b68c1b41956fcc":{"type":"File","value":"a1d3b65c429beb3a2ccaa966b99b42a99d50b157370aadea09b68c1b41956fcc"},"File:b034c3a8dbaf4b997aad359b43ef57dc5e9000c6e8e99d861a555a8dfb72c033":{"type":"File","value":"b034c3a8dbaf4b997aad359b43ef57dc5e9000c6e8e99d861a555a8dfb72c033"},"File:b1a96e816a51f16c120dc026c98936382bd421ab9689011981642bc790754dcb":{"type":"File","value":"b1a96e816a51f16c120dc026c98936382bd421ab9689011981642bc790754dcb"},"File:b6e6cbf127646998afd298e71107a2238a751891af559b07b39a1f01d4290f85":{"type":"File","value":"b6e6cbf127646998afd298e71107a2238a751891af559b07b39a1f01d4290f85"},"File:b81d9a705571e8e5ce87eb009d2b09f786460a182347be18a50571bd50babcd1":{"type":"File","value":"b81d9a705571e8e5ce87eb009d2b09f786460a182347be18a50571bd50babcd1"},"File:bc81010e282ac2e8a7f165dfd3e87e06b69c52e62330c8c34de7be4653e864a4":{"type":"File","value":"bc81010e282ac2e8a7f165dfd3e87e06b69c52e62330c8c34de7be4653e864a4"},"File:d568886c4cd8ad3b842ad48de53d012686301b76bdb14e5aaed6aabf96d0bb35":{"type":"File","value":"d568886c4cd8ad3b842ad48de53d012686301b76bdb14e5aaed6aabf96d0bb35"},"File:d823e5d3b21d1612eecb57b2621eab38d4d6958364d6b7f9dbb313468606e201":{"type":"File","value":"d823e5d3b21d1612eecb57b2621eab38d4d6958364d6b7f9dbb313468606e201"},"File:e100dbf2e00743d6a1f16ad0067d2d1ca20e14ff2a16e8341ecac3320e22eb54":{"type":"File","value":"e100dbf2e00743d6a1f16ad0067d2d1ca20e14ff2a16e8341ecac3320e22eb54"},"File:eec9276e4a86d564b9ea83379d2f9fc3b1b20f03088817f62005004ede3b07e1":{"type":"File","value":"eec9276e4a86d564b9ea83379d2f9fc3b1b20f03088817f62005004ede3b07e1"},"File:effe36e64e6f125ca7e48ed5eabb369b1968ec84f78bab0448162017ee41ea72":{"type":"File","value":"effe36e64e6f125ca7e48ed5eabb369b1968ec84f78bab0448162017ee41ea72"},"File:fbaec4f492346e02642c81d3c834ec96edd34556fd140bf907d02bc4a25eab5f":{"type":"File","value":"fbaec4f492346e02642c81d3c834ec96edd34556fd140bf907d02bc4a25eab5f"},"File:fe41c28bc09cd302108174eadb0b3a47ad1e3232ba4a6eb545178e15d5d3dc2a":{"type":"File","value":"fe41c28bc09cd302108174eadb0b3a47ad1e3232ba4a6eb545178e15d5d3dc2a"},"File:ffd9c6624a1e411395411ed362d74359c9323138ec6030aff4dfef466987e410":{"type":"File","value":"ffd9c6624a1e411395411ed362d74359c9323138ec6030aff4dfef466987e410"}},"chains":[{"id":"sandbox_files","root":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","edges":[{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:6dd4886a473e515a543ebc9705e63742744aac3de65ec5dc5d9881f6eacc1b8e"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:047b34d0aaa61a5280ad1d02bdc38b427ed0f14971ea5b4af06d12d33ca1e757"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:d823e5d3b21d1612eecb57b2621eab38d4d6958364d6b7f9dbb313468606e201"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:716616214afc8fedf11ed6c35313fafde5d879a47ab386adbf30df051be4ef22"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:fe41c28bc09cd302108174eadb0b3a47ad1e3232ba4a6eb545178e15d5d3dc2a"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:a1d3b65c429beb3a2ccaa966b99b42a99d50b157370aadea09b68c1b41956fcc"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:fbaec4f492346e02642c81d3c834ec96edd34556fd140bf907d02bc4a25eab5f"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:654239b2e5cf565fc632dd6c22ad0fad83e7639ff335ec4e9e67e5276a420679"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:88bb2503f047c481badd93cf9fc854d2bf29c0bdca460acfe9ec827dbae83b4e"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:776377768e9df7cde2e702267d4e4e2084ca13cf42de3ef3a1cad0c7a00db63e"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:33f3a633364d082f149c6dc7ee8a90bf93ebbf3fa0bca8b75f2d01263e5e5320"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:42c1e7838c4983e06a07f0161677f3028eebb23d7bd084a539fa4dca9d667be8"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:6a51233d42dd5a9dffb7c3f868c8886aba28568e57f1775f5bdbff9156b80344"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:bc81010e282ac2e8a7f165dfd3e87e06b69c52e62330c8c34de7be4653e864a4"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:b034c3a8dbaf4b997aad359b43ef57dc5e9000c6e8e99d861a555a8dfb72c033"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:21f671ecef25e5b5ec23fd24c14cac55d345ef09d790f9eb5a552703a82bf08a"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:438000ce1065551724d3513670aad771603de5ef6d403c53dcfb1a59e6aef9f9"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:345be9f7f60c82dfd70d64e90d0f8e727c9e8f542e61695f1936212416d08598"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:b81d9a705571e8e5ce87eb009d2b09f786460a182347be18a50571bd50babcd1"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:58f3267670dc085fa4d980d6c1d0a7476fbca60d25366728d1cdb60fde6e3ff0"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:e100dbf2e00743d6a1f16ad0067d2d1ca20e14ff2a16e8341ecac3320e22eb54"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:206148e46fd0a8c08746b3ebd3f15d6659d1346fbd12a068790c119f68c7b3e8"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:a05692a4c12d23406e3ac61418927e31c7f11410406bb95decfb89bc127df5cd"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:b1a96e816a51f16c120dc026c98936382bd421ab9689011981642bc790754dcb"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:87e8fbb0f00ab3d2d354ae9b454a5df3fd88f994deb0bfe6a05358cb33083a6e"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:9190a646a6b5cd1c749044f22f42c8d9d301e97ab2a7abfd3b138d2d1216904c"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:b6e6cbf127646998afd298e71107a2238a751891af559b07b39a1f01d4290f85"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:956f608f1ea7560f2ec9180a5a61e4c9c1ce1bbdc592766f300c283a7c87ecc8"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:ffd9c6624a1e411395411ed362d74359c9323138ec6030aff4dfef466987e410"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:6354fa2c299b3cac72fe7bb8c13a79fbbaf1d87fbf733867d4dde079261c6b70"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:8c840edaf753711e9dea0a2244011232bc746205f93445c035acdcdbdc9da471"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:76a5d2ae6520f82e0e363f449102ecec9a8de4895048d8de19324fc134f72784"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:38d9be401294b095c582705ed98ff5680f2dae7770df11d3c712552dc944e4f7"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:d568886c4cd8ad3b842ad48de53d012686301b76bdb14e5aaed6aabf96d0bb35"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:2a75ddf7ae40a6e0d8c3e8ba25346558a608d13d910e7693b0eb2966ecdf7fa1"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:21eb820233cea96405a891cc02b45b644963992c09df634b93cc4a612f765627"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:192992ff6989f3efdcbaa752fb07f86a8b075f3c46b70915c3d01f727a2901ae"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:00a7585f20162fb56ad93913434b27c850baa207e3e3343f2076353a9f776a1e"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:65020dc9ad4971088d9bbabb88220c21c00c4a69462e20aea2bdac1178b77b83"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:eec9276e4a86d564b9ea83379d2f9fc3b1b20f03088817f62005004ede3b07e1"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:effe36e64e6f125ca7e48ed5eabb369b1968ec84f78bab0448162017ee41ea72"},{"edge_kind":"extracted","from_key":"File:9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","to_key":"File:0de35c68144a0dd99f2cd149165372148fa8b569d114d52b7c08f409b4deb7fb"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":37,"spawned_processes_count":37,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":45,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":42,"files_written_count":12,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["aenjaris","evasive"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6ac12e02bd8a6d007e00c326","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Agent","submit_name":"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","analysis_start_time":"2026-10-03T16:32:03+00:00","indicators_count":{"informative":148,"suspicious":41,"malicious":11},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}],"processes":[{"pid":2948,"ppid":0,"name":"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe","command_line":"","sha256":"9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757","normalized_path":"C:\\9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757.exe","uid":"00000000-00002948","icon":"$90"},{"pid":3124,"ppid":2948,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%WINDIR%\\NTKA.exe.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002948","uid":"00000000-00003124"},{"pid":5916,"ppid":3124,"name":"NTKA.exe","command_line":"","sha256":"047b34d0aaa61a5280ad1d02bdc38b427ed0f14971ea5b4af06d12d33ca1e757","normalized_path":"%WINDIR%\\NTKA.exe","parent_uid":"00000000-00003124","uid":"00000000-00005916"},{"pid":3216,"ppid":5916,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%WINDIR%\\system\\SHLSGCM.exe.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00005916","uid":"00000000-00003216"},{"pid":7192,"ppid":3216,"name":"SHLSGCM.exe","command_line":"","sha256":"b81d9a705571e8e5ce87eb009d2b09f786460a182347be18a50571bd50babcd1","normalized_path":"%WINDIR%\\system\\SHLSGCM.exe","parent_uid":"00000000-00003216","uid":"00000000-00007192"},{"pid":7336,"ppid":7192,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%WINDIR%\\system\\HQJQFTK.exe.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00007192","uid":"00000000-00007336"},{"pid":2800,"ppid":7336,"name":"HQJQFTK.exe","command_line":"","sha256":"21f671ecef25e5b5ec23fd24c14cac55d345ef09d790f9eb5a552703a82bf08a","normalized_path":"%WINDIR%\\system\\HQJQFTK.exe","parent_uid":"00000000-00007336","uid":"00000000-00002800"},{"pid":7324,"ppid":2800,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%WINDIR%\\OUQBA.exe.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00002800","uid":"00000000-00007324"},{"pid":6980,"ppid":7324,"name":"OUQBA.exe","command_line":"","sha256":"fe41c28bc09cd302108174eadb0b3a47ad1e3232ba4a6eb545178e15d5d3dc2a","normalized_path":"%WINDIR%\\OUQBA.exe","parent_uid":"00000000-00007324","uid":"00000000-00006980"},{"pid":6108,"ppid":6980,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%WINDIR%\\system32\\YAU.exe.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00006980","uid":"00000000-00006108"},{"pid":376,"ppid":6980,"name":"WerFault.exe","command_line":"-u -p 6980 -s 1020","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006980","uid":"00000000-00000376"},{"pid":4764,"ppid":2800,"name":"WerFault.exe","command_line":"-u -p 2800 -s 996","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002800","uid":"00000000-00004764"},{"pid":7756,"ppid":7192,"name":"WerFault.exe","command_line":"-u -p 7192 -s 1292","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007192","uid":"00000000-00007756"},{"pid":6092,"ppid":5916,"name":"WerFault.exe","command_line":"-u -p 5916 -s 1300","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00005916","uid":"00000000-00006092"},{"pid":5052,"ppid":2948,"name":"WerFault.exe","command_line":"-u -p 2948 -s 1128","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002948","uid":"00000000-00005052"},{"pid":5200,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 2948 -ip 2948","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005200","icon":"$91"},{"pid":6760,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 5916 -ip 5916","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006760","icon":"$92"},{"pid":7760,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 7192 -ip 7192","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007760","icon":"$93"},{"pid":2516,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 516 -p 2800 -ip 2800","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002516","icon":"$94"},{"pid":408,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 6980 -ip 6980","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00000408","icon":"$95"},{"pid":4036,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 464 -p 1116 -ip 1116","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004036","icon":"$96"},{"pid":7584,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 7988 -ip 7988","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007584","icon":"$97"},{"pid":1344,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 564 -p 7844 -ip 7844","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001344","icon":"$98"},{"pid":5716,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 564 -p 3504 -ip 3504","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005716","icon":"$99"},{"pid":5644,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 560 -p 7752 -ip 7752","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005644","icon":"$9a"},{"pid":5088,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 556 -p 2532 -ip 2532","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005088","icon":"$9b"},{"pid":2284,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 1536 -ip 1536","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002284","icon":"$9c"},{"pid":3600,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 512 -p 7076 -ip 7076","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003600","icon":"$9d"},{"pid":1876,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 520 -p 7420 -ip 7420","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001876","icon":"$9e"},{"pid":6188,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 564 -p 6928 -ip 6928","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006188","icon":"$9f"},{"pid":3848,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 524 -p 2864 -ip 2864","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003848","icon":"$a0"},{"pid":7868,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 516 -p 5352 -ip 5352","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007868","icon":"$a1"},{"pid":4656,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 564 -p 940 -ip 940","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004656","icon":"$a2"},{"pid":7300,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 4700 -ip 4700","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007300","icon":"$a3"},{"pid":5084,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 556 -p 5596 -ip 5596","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005084","icon":"$a4"},{"pid":6340,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 544 -p 2392 -ip 2392","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006340","icon":"$a5"},{"pid":6276,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 544 -p 4352 -ip 4352","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006276","icon":"$a6"}],"all_imported_dlls":["cmdext.dll","ntdll.dll","gdi32full.dll","oleaut32.dll","vcruntime140.dll","sspicli.dll","shell32.dll","comctl32.dll","msIso.dll","TextInputFramework.dll","CoreUIComponents.dll","rpcrt4.dll","IPHLPAPI.DLL","Windows.StateRepositoryPS.dll","apphelp.dll","kernel.appcore.dll","bcryptprimitives.dll","cryptbase.dll","windows.storage.dll","cryptsp.dll","uxtheme.dll","win32u.dll","bcrypt.dll","ws2_32.dll","aepic.dll","ntmarta.dll","propsys.dll","WinTypes.dll","combase.dll","powrprof.dll","imagehlp.dll","wow64win.dll","kernel32.dll","msvcp140.dll","cldapi.dll","clbcatq.dll","KernelBase.dll","gdi32.dll","iertutil.dll","user32.dll","msvcrt.dll","profapi.dll","fltLib.dll","CoreMessaging.dll","dwmapi.dll","msvcp_win.dll","SHCore.dll","VxSSL32.dll","ole32.dll","wow64cpu.dll","psapi.dll","wow64.dll","msctf.dll","edputil.dll","ucrtbase.dll","advapi32.dll","shlwapi.dll","imm32.dll","sechost.dll","cfgmgr32.dll","urlmon.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"LYVXACA.exe","sha256":"6dd4886a473e515a543ebc9705e63742744aac3de65ec5dc5d9881f6eacc1b8e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"NTKA.exe","sha256":"047b34d0aaa61a5280ad1d02bdc38b427ed0f14971ea5b4af06d12d33ca1e757","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"NVE.exe","sha256":"d823e5d3b21d1612eecb57b2621eab38d4d6958364d6b7f9dbb313468606e201","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"OMZLOC.exe","sha256":"716616214afc8fedf11ed6c35313fafde5d879a47ab386adbf30df051be4ef22","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"OUQBA.exe","sha256":"fe41c28bc09cd302108174eadb0b3a47ad1e3232ba4a6eb545178e15d5d3dc2a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"PQLZSP.exe","sha256":"a1d3b65c429beb3a2ccaa966b99b42a99d50b157370aadea09b68c1b41956fcc","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"QEQ.exe","sha256":"fbaec4f492346e02642c81d3c834ec96edd34556fd140bf907d02bc4a25eab5f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"RCP.exe","sha256":"654239b2e5cf565fc632dd6c22ad0fad83e7639ff335ec4e9e67e5276a420679","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"RSFO.exe","sha256":"88bb2503f047c481badd93cf9fc854d2bf29c0bdca460acfe9ec827dbae83b4e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SUL.exe","sha256":"776377768e9df7cde2e702267d4e4e2084ca13cf42de3ef3a1cad0c7a00db63e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"QWNAL.exe","sha256":"33f3a633364d082f149c6dc7ee8a90bf93ebbf3fa0bca8b75f2d01263e5e5320","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"RBFFNT.exe","sha256":"42c1e7838c4983e06a07f0161677f3028eebb23d7bd084a539fa4dca9d667be8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"YAU.exe","sha256":"6a51233d42dd5a9dffb7c3f868c8886aba28568e57f1775f5bdbff9156b80344","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"FLX.exe","sha256":"bc81010e282ac2e8a7f165dfd3e87e06b69c52e62330c8c34de7be4653e864a4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"HNHWPQB.exe","sha256":"b034c3a8dbaf4b997aad359b43ef57dc5e9000c6e8e99d861a555a8dfb72c033","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"HQJQFTK.exe","sha256":"21f671ecef25e5b5ec23fd24c14cac55d345ef09d790f9eb5a552703a82bf08a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"JOYJ.exe","sha256":"438000ce1065551724d3513670aad771603de5ef6d403c53dcfb1a59e6aef9f9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"MVJOU.exe","sha256":"345be9f7f60c82dfd70d64e90d0f8e727c9e8f542e61695f1936212416d08598","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SHLSGCM.exe","sha256":"b81d9a705571e8e5ce87eb009d2b09f786460a182347be18a50571bd50babcd1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"TTCMDR.exe","sha256":"58f3267670dc085fa4d980d6c1d0a7476fbca60d25366728d1cdb60fde6e3ff0","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"VFFNFTJ.exe","sha256":"e100dbf2e00743d6a1f16ad0067d2d1ca20e14ff2a16e8341ecac3320e22eb54","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"LYVXACA.exe.bat","sha256":"206148e46fd0a8c08746b3ebd3f15d6659d1346fbd12a068790c119f68c7b3e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"NTKA.exe.bat","sha256":"a05692a4c12d23406e3ac61418927e31c7f11410406bb95decfb89bc127df5cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"NVE.exe.bat","sha256":"b1a96e816a51f16c120dc026c98936382bd421ab9689011981642bc790754dcb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"OMZLOC.exe.bat","sha256":"87e8fbb0f00ab3d2d354ae9b454a5df3fd88f994deb0bfe6a05358cb33083a6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"OUQBA.exe.bat","sha256":"9190a646a6b5cd1c749044f22f42c8d9d301e97ab2a7abfd3b138d2d1216904c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"PQLZSP.exe.bat","sha256":"b6e6cbf127646998afd298e71107a2238a751891af559b07b39a1f01d4290f85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"QEQ.exe.bat","sha256":"956f608f1ea7560f2ec9180a5a61e4c9c1ce1bbdc592766f300c283a7c87ecc8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"RCP.exe.bat","sha256":"ffd9c6624a1e411395411ed362d74359c9323138ec6030aff4dfef466987e410","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"RSFO.exe.bat","sha256":"6354fa2c299b3cac72fe7bb8c13a79fbbaf1d87fbf733867d4dde079261c6b70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SUL.exe.bat","sha256":"8c840edaf753711e9dea0a2244011232bc746205f93445c035acdcdbdc9da471","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"QWNAL.exe.bat","sha256":"76a5d2ae6520f82e0e363f449102ecec9a8de4895048d8de19324fc134f72784","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"RBFFNT.exe.bat","sha256":"38d9be401294b095c582705ed98ff5680f2dae7770df11d3c712552dc944e4f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"YAU.exe.bat","sha256":"d568886c4cd8ad3b842ad48de53d012686301b76bdb14e5aaed6aabf96d0bb35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"FLX.exe.bat","sha256":"2a75ddf7ae40a6e0d8c3e8ba25346558a608d13d910e7693b0eb2966ecdf7fa1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"HNHWPQB.exe.bat","sha256":"21eb820233cea96405a891cc02b45b644963992c09df634b93cc4a612f765627","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"HQJQFTK.exe.bat","sha256":"192992ff6989f3efdcbaa752fb07f86a8b075f3c46b70915c3d01f727a2901ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"JOYJ.exe.bat","sha256":"00a7585f20162fb56ad93913434b27c850baa207e3e3343f2076353a9f776a1e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"MVJOU.exe.bat","sha256":"65020dc9ad4971088d9bbabb88220c21c00c4a69462e20aea2bdac1178b77b83","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SHLSGCM.exe.bat","sha256":"eec9276e4a86d564b9ea83379d2f9fc3b1b20f03088817f62005004ede3b07e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"TTCMDR.exe.bat","sha256":"effe36e64e6f125ca7e48ed5eabb369b1968ec84f78bab0448162017ee41ea72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"VFFNFTJ.exe.bat","sha256":"0de35c68144a0dd99f2cd149165372148fa8b569d114d52b7c08f409b4deb7fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"path":"%WINDIR%\\NTKA.exe","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"path":"%WINDIR%\\NTKA.exe.bat","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"path":"%WINDIR%\\System\\SHLSGCM.exe","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"path":"%WINDIR%\\System\\SHLSGCM.exe.bat","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"path":"%WINDIR%\\System\\HQJQFTK.exe","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"path":"%WINDIR%\\System\\HQJQFTK.exe.bat","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"path":"%WINDIR%\\OUQBA.exe","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"path":"%WINDIR%\\OUQBA.exe.bat","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"path":"%WINDIR%\\SysWOW64\\YAU.exe","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"path":"%WINDIR%\\SysWOW64\\YAU.exe.bat","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2948:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2948:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\SM0:2948:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SM0:2948:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\SM0:2948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SM0:2948:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5916:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5916:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5916:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5916:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SM0:5916:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\SM0:5916:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SM0:5916:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\SM0:5916:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7192:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7192:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7192:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7192:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\SM0:7192:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SM0:7192:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\SM0:7192:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SM0:7192:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2800:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2800:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2800:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2800:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\SM0:2800:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\SM0:2800:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SM0:2800:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SM0:2800:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6980:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6980:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\SM0:6980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"Local\\SM0:6980:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SM0:6980:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]},{"name":"SM0:6980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ac12e02bd8a6d007e00c326"}]}]}},"report_ids":{"sandbox_job_ids":["6ac12e02bd8a6d007e00c326"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 9956d4433d4b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9956d4433d4b…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 20/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 9956d4433d4b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9956d4433d4b…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 20/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9956d4433d4b79e68436785a40cee5fd65cfd498e2e428991eaa05aee7e3e757"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 9956d4433d4b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9956d4433d4b…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 20/28 AV engines flagged this file. 10 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$La7","11",{}]]