34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 4c:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/grayware_confidence_100% Sample ac2d47dc2d33… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ac2d47dc2d33…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 13/27 AV engines flagged this file. 4 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21","keywords":["Malicious","Win/grayware_confidence_100%","malware analysis","sandbox report","threat intelligence","ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21"],"about":{"@type":"SoftwareApplication","name":"xf-mccs6.exe","applicationCategory":["peexe","executable"],"identifier":"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/grayware_confidence_100%","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T461,Pattern match: "http://dmd.metaservices.microsoft.com/dms/metadata.svc" Pattern match: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?979a24a99b50b0b9 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?487032890b543744 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBuN56dlW1Lzehhu%2FtdSD3U%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcd.com" Heuristic match: "GET /sv.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcb.com" Pattern match: "http://www.symauth.com/cps0*"37:T404,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp")38:T13ef,"3_Activation_Keygen.exe" called "NtOpenSection" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtCreateSection" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQueryInformationToken" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtOpenKeyEx" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQueryValueKey" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtOpenFile" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtSetInformationKey" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQueryInformationFile" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtEnumerateKey" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQueryKey" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtEnumerateValueKey" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtProtectVirtualMemory" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtOpenThread" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtResumeThread" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQueryAttributesFile" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtMapViewOfSection" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQueryVolumeInformationFile" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtSetInformationProcess" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "LdrGetDllHandle" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQuerySystemInformation" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQueryInformationProcess" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtAllocateVirtualMemory" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "LdrLoadDll" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "LoadLibrary" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQueryVirtualMemory" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtSuspendThread" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtGetContextThread" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQueryDefaultLocale" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtConnectPort" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtRequestWaitReplyPort" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtCreateEvent" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtOpenMutant" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtAlpcConnectPort" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtCreateMutant" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtAlpcSendWaitReceivePort" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtOpenDirectoryObject" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtOpenThreadToken" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtOpenProcessToken" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "RpcStringBindingComposeW" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtAlpcConnectPortEx" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQueryObject" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtQueryLicenseValue" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtOpenEvent" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "LdrUnloadDll" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtWaitForMultipleObjects" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtDeviceIoControlFile" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtCreateThreadEx" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtSetInformationThread" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtNotifyChangeKey" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtDelayExecution" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtReadFile" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "NtTerminateProcess" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "RtlGetNtProductType" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "RtlGetVersion" (PID: 8040) (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetKeyState" (PID: 8040) (UID: 00000000-00008040)39:T3e2e,"3_Activation_Keygen.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetHandleCount (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter RtlUnwind (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter InterlockedIncrement (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter InterlockedDecrement (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateFontA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetObjectA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CallWindowProcA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter PostMessageA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetDlgItemTextA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateDialogParamA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetWindowTextA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter LoadBitmapA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetWindowLongA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetWindowLongA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SetWindowRgn (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter DispatchMessageA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetDlgItemTextA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter PostQuitMessage (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter EndDialog (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter DefWindowProcA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter MoveWindow (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter waveOutOpen (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter waveOutUnprepareHeader (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter waveOutReset (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter waveOutWrite (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter waveOutClose (UID: 00000000-00008040) "3_Activation_Keygen.exe" called "GetProcAddress" with a parameter waveOutPrepareHeader (UID: 00000000-00008040)3a:T6450,Found reference to API (Indicator: "LoadLibraryA"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API (Indicator: "GetProcAddress"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API (Indicator: "VirtualProtect"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API (Indicator: "VirtualFree"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API (Indicator: "ExitProcess"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API (Indicator: "BitBlt"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API (Indicator: "GetDC"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadBitmapA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00008040.00000000.78323.7EC90000.00000002.mdmp, 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp, 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp")3b:T111f,"\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback" in Source: 00000000-00008040.00000000.78323.00508000.00000004.mdmp 00000000-00008040.00000001.80240.00508000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Sans SerifckS S" in Source: 00000000-00008040.00000000.78323.00508000.00000004.mdmp 00000000-00008040.00000001.80240.00508000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\App Managementent}df]" in Source: 00000000-00008040.00000000.78323.00508000.00000004.mdmp 00000000-00008040.00000001.80240.00508000.00000004.mdmp 00000000-00008040.00000002.82163.00508000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\App Management" in Source: 00000000-00008040.00000000.78323.027B0000.00000004.mdmp 00000000-00008040.00000001.80240.027B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{afe9d18c-bc79-401b-8755-e68ee7c32c02}\Properties" in Source: 00000000-00008040.00000000.78323.02960000.00000004.mdmp 00000000-00008040.00000001.80240.02960000.00000004.mdmp 00000000-00008040.00000002.82163.02960000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008040.00000000.78323.02960000.00000004.mdmp 00000000-00008040.00000001.80240.02960000.00000004.mdmp 00000000-00008040.00000002.82163.02960000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "E\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguageP" in Source: 00000000-00008040.00000002.82163.00508000.00000004.mdmp3c:T1a72,"\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback" in Source: 00000000-00008040.00000000.78323.00508000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Sans SerifckS S" in Source: 00000000-00008040.00000000.78323.00508000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\App Managementent}df]" in Source: 00000000-00008040.00000000.78323.00508000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\App Management" in Source: 00000000-00008040.00000000.78323.027B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{afe9d18c-bc79-401b-8755-e68ee7c32c02}\Properties" in Source: 00000000-00008040.00000000.78323.02960000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008040.00000000.78323.02960000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00008040.00000000.78323.7EC90000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback" in Source: 00000000-00008040.00000001.80240.00508000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Sans SerifckS S" in Source: 00000000-00008040.00000001.80240.00508000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\App Managementent}df]" in Source: 00000000-00008040.00000001.80240.00508000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\App Management" in Source: 00000000-00008040.00000001.80240.027B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{afe9d18c-bc79-401b-8755-e68ee7c32c02}\Properties" in Source: 00000000-00008040.00000001.80240.02960000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008040.00000001.80240.02960000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00008040.00000001.80240.7EC90000.00000002.mdmp "E\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguageP" in Source: 00000000-00008040.00000002.82163.00508000.00000004.mdmp "\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows\App Managementent}df]" in Source: 00000000-00008040.00000002.82163.00508000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Render\{afe9d18c-bc79-401b-8755-e68ee7c32c02}\Properties" in Source: 00000000-00008040.00000002.82163.02960000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00008040.00000002.82163.02960000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00008040.00000002.82163.7EC90000.00000002.mdmp3d:T1302,"3_Activation_Keygen.exe" loaded module "C:\3_Activation_Keygen.exe" at 00400000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 95130000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\ntdll.dll" at 77150000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\System32\wow64.dll" at 5CC60000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\System32\wow64win.dll" at 5CBD0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 02640000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\System32\user32.dll" at 027C0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\System32\wow64cpu.dll" at 5CC50000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\kernel32.dll" at 75D40000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\KernelBase.dll" at 75FE0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\apphelp.dll" at 73AC0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\gdi32.dll" at 74F30000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\gdi32full.dll" at 76F60000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\msvcp_win.dll" at 74F60000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\ucrtbase.dll" at 75C20000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\user32.dll" at 76C80000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\win32u.dll" at 754D0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\winmm.dll" at 721D0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\msvcrt.dll" at 75230000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\winmmbase.dll" at 72210000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\cfgmgr32.dll" at 770C0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\imm32.dll" at 75580000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\combase.dll" at 74FE0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\rpcrt4.dll" at 76810000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\sspicli.dll" at 73B70000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\cryptbase.dll" at 73B60000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 76930000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\sechost.dll" at 73BA0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\Temp\VxSSL32.dll" at 72180000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\ws2_32.dll" at 752F0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\fltLib.dll" at 738A0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\Temp\VxOle32.dll" at 72130000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\advapi32.dll" at 754F0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\ole32.dll" at 76E00000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\oleaut32.dll" at 76A20000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\uxtheme.dll" at 733E0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\msctf.dll" at 76B20000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\kernel.appcore.dll" at 77120000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\TextInputFramework.dll" at 72970000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\CoreUIComponents.dll" at 726A0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\SHCore.dll" at 76990000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\CoreMessaging.dll" at 728E0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\ntmarta.dll" at 72D60000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\WinTypes.dll" at 725D0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\dwmapi.dll" at 729F0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\MMDevAPI.dll" at 720B0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\devobj.dll" at 73460000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\propsys.dll" at 72EB0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\wdmaud.drv" at 72070000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\ksuser.dll" at 72060000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\avrt.dll" at 72050000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\AudioSes.dll" at 71F50000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\powrprof.dll" at 75BD0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\msacm32.drv" at 71F40000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\msacm32.dll" at 71F20000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\midimap.dll" at 71F10000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SysWOW64\clbcatq.dll" at 765F00003e:T758,"3_Activation_Keygen.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75fe0000 "3_Activation_Keygen.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75fe0000 "3_Activation_Keygen.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75fe0000 "3_Activation_Keygen.exe" loaded module "KERNEL32" at base 75d40000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72130000 "3_Activation_Keygen.exe" loaded module "KERNEL32.DLL" at base 75d40000 "3_Activation_Keygen.exe" loaded module "GDI32.DLL" at base 74f30000 "3_Activation_Keygen.exe" loaded module "USER32.DLL" at base 76c80000 "3_Activation_Keygen.exe" loaded module "WINMM.DLL" at base 721d0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733e0000 "3_Activation_Keygen.exe" loaded module "OLEAUT32.DLL" at base 76a20000 "3_Activation_Keygen.exe" loaded module "RPCRT4.DLL" at base 76810000 "3_Activation_Keygen.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76c80000 "3_Activation_Keygen.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76c80000 "3_Activation_Keygen.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 74fe0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76b20000 "3_Activation_Keygen.exe" loaded module "WDMAUD.DRV" at base 72070000 "3_Activation_Keygen.exe" loaded module "MMDEVAPI.DLL" at base 720b0000 "3_Activation_Keygen.exe" loaded module "AUDIOSES.DLL" at base 71f50000 "3_Activation_Keygen.exe" loaded module "MSACM32.DRV" at base 71f40000 "3_Activation_Keygen.exe" loaded module "MIDIMAP.DLL" at base 71f10000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 720b0000 "3_Activation_Keygen.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76e000003f:T6019,"3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\PENDINGDELETE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\SETTINGS\LANGUAGECONFIGURATION"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\FEATUREDEVELOPMENTPROPERTIES"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\OLE\FEATUREDEVELOPMENTPROPERTIES"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\DISPLAY"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\3_ACTIVATION_KEYGEN.EXE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\OLEAUT"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CTF\COMPATIBILITY\3_ACTIVATION_KEYGEN.EXE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CTF\"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\OEM"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\INPUT"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\SYSTEM\CURRENTCONTROLSET\CONTROL\MEDIAPROPERTIES\PRIVATEPROPERTIES\JOYSTICK\WINMM"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{12F21B3A-E37D-4AB3-B0FE-49DC17EC54F5}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{12F21B3A-E37D-4AB3-B0FE-49DC17EC54F5}\PROPERTIES"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{106D7897-15B2-4FEB-B369-C104D6E44577}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{106D7897-15B2-4FEB-B369-C104D6E44577}\PROPERTIES"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{6C9140EB-862D-42FC-98AF-5F08EA8F04E7}\PROPERTIES"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\PROPERTIES"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&22A99211&0&0001"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EMICINTOPO"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EMICINTOPO\PROPERTIES\{D1885396-39D"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EMICINTOPO\PROPERTIES\{194EF948-7CD"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ECDINTOPO"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ECDINTOPO\PROPERTIES\{D1885396-39D8"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ECDINTOPO\PROPERTIES\{194EF948-7CDB"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ESPEAKERWAVE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ESPEAKERWAVE\PROPERTIES\{D1885396-3"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ESPEAKERWAVE\PROPERTIES\{194EF948-7"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EMICINWAVE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EMICINWAVE\PROPERTIES\{D1885396-39D"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EMICINWAVE\PROPERTIES\{194EF948-7CD"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ECDINWAVE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ECDINWAVE\PROPERTIES\{D1885396-39D8"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ECDINWAVE\PROPERTIES\{194EF948-7CDB"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EHEADPHONETOPO"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EHEADPHONETOPO\PROPERTIES\{D1885396"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EHEADPHONETOPO\PROPERTIES\{194EF948"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ESPEAKERTOPO"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ESPEAKERTOPO\PROPERTIES\{D1885396-3"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ESPEAKERTOPO\PROPERTIES\{194EF948-7"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&22A99211&0&0001\PROPERTIES\{D1885396-39D8-4777-BCFF-5E3241483416}\0000"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&22A99211&0&0001\PROPERTIES\{B3F8FA53-0004-438E-9003-51A46E139BFC}\0007"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{825E8FD3-6467-4A5B-ABFB-BB010734FF4D}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC\EXTENSIONS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK\VERDANA"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK\MS SANS SERIF"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{FA445657-9379-11D6-B41A-00065B83EE53}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APP MANAGEMENT"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APP MANAGEMENT"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\KEYBOARD LAYOUT\TOGGLE"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\CTF\DIRECTSWITCHHOTKEYS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCHANDLER32"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCHANDLER32"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCHANDLER"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCHANDLER"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\LOCALSERVER32"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\LOCALSERVER32"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\LOCALSERVER"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\LOCALSERVER"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\ELEVATION"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\ELEVATION"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\1"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\10"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\2"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\3"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\4"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\5"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\6"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\7"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\8"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\9"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\MULTIMEDIA\AUDIO"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\AUDIO"; Key: ""; Value: "")40:T84a0,"3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "3_ACTIVATION_KEYGEN.EXE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "3_ACTIVATION_KEYGEN"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000602XX"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CTF"; Key: "ENABLEANCHORCONTEXT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\OEM"; Key: "DEVICEFORM"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INPUT"; Key: "RESYNCRESETTIME"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\INPUT"; Key: "MAXRESYNCATTEMPTS"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WAVE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WAVE1"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WAVE2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WAVE3"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WAVE4"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WAVE5"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WAVE6"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WAVE7"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WAVE8"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WAVE9"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "MIDI"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "MIDI1"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "MIDI2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "MIDI3"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "MIDI4"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "MIDI5"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "MIDI6"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "MIDI7"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "MIDI8"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "MIDI9"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKCU\SYSTEM\CURRENTCONTROLSET\CONTROL\MEDIAPROPERTIES\PRIVATEPROPERTIES\JOYSTICK\WINMM"; Key: "WHEEL"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{12F21B3A-E37D-4AB3-B0FE-49DC17EC54F5}"; Key: "PROTOCOL"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{12F21B3A-E37D-4AB3-B0FE-49DC17EC54F5}\PROPERTIES"; Key: "{83DA6326-97A6-4088-9453-A1923F573B29},6"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{12F21B3A-E37D-4AB3-B0FE-49DC17EC54F5}"; Key: "DEVICESTATE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}"; Key: "PROTOCOL"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{83DA6326-97A6-4088-9453-A1923F573B29},6"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}"; Key: "DEVICESTATE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}"; Key: "PROTOCOL"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{83DA6326-97A6-4088-9453-A1923F573B29},6"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}"; Key: "DEVICESTATE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{106D7897-15B2-4FEB-B369-C104D6E44577}"; Key: "PROTOCOL"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{106D7897-15B2-4FEB-B369-C104D6E44577}\PROPERTIES"; Key: "{83DA6326-97A6-4088-9453-A1923F573B29},6"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{106D7897-15B2-4FEB-B369-C104D6E44577}"; Key: "DEVICESTATE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{6C9140EB-862D-42FC-98AF-5F08EA8F04E7}"; Key: "PROTOCOL"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{6C9140EB-862D-42FC-98AF-5F08EA8F04E7}\PROPERTIES"; Key: "{83DA6326-97A6-4088-9453-A1923F573B29},6"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{6C9140EB-862D-42FC-98AF-5F08EA8F04E7}"; Key: "DEVICESTATE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{F3E80BEF-1723-4FF2-BCC4-7F83DC5E46D4},3"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{5A9125B7-F367-4924-ACE2-0803A4A3A471},0"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},15"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}"; Key: "LEVEL:0"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{F3E80BEF-1723-4FF2-BCC4-7F83DC5E46D4},3"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{5A9125B7-F367-4924-ACE2-0803A4A3A471},0"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},15"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}"; Key: "LEVEL:0"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{5A9125B7-F367-4924-ACE2-0803A4A3A471},2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}"; Key: "LEVEL:2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{5A9125B7-F367-4924-ACE2-0803A4A3A471},2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}"; Key: "LEVEL:2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{194EF948-7CDB-403E-9F47-19418F7B24FD},1"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{194EF948-7CDB-403E-9F47-19418F7B24FD},1"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN-US"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS"; Key: "EN"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&22A99211&0&0001"; Key: "CONFIGFLAGS"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EMICINTOPO\PROPERTIES\{D1885396-39D"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ECDINTOPO\PROPERTIES\{D1885396-39D8"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ESPEAKERWAVE\PROPERTIES\{D1885396-3"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EMICINWAVE\PROPERTIES\{D1885396-39D"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ECDINWAVE\PROPERTIES\{D1885396-39D8"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#EHEADPHONETOPO\PROPERTIES\{D1885396"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{6994AD04-93EF-11D0-A3CC-00A0C9223196}\##?#HDAUDIO#FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034#4&22A99211&0&0001#{6994AD04-93EF-11D0-A3CC-00A0C9223196}\#ESPEAKERTOPO\PROPERTIES\{D1885396-3"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WDMAUD.DRV"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEPROCESSSEARCHMODE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{A45C254E-DF1C-4EFD-8020-67D146A850E0},2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{026E516E-B814-414B-83CD-856D6FEF4822},2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},26"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&22A99211&0&0001\PROPERTIES\{D1885396-39D8-4777-BCFF-5E3241483416}\0000"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\HDAUDIO\FUNC_01&VEN_8384&DEV_7680&SUBSYS_83847680&REV_1034\4&22A99211&0&0001\PROPERTIES\{B3F8FA53-0004-438E-9003-51A46E139BFC}\0007"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},6"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},1"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{1DA5D803-D492-4EDD-8C23-E0C0FFEE7F0E},0"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC\EXTENSIONS"; Key: "NDROLEEXTDLL"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{A45C254E-DF1C-4EFD-8020-67D146A850E0},2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{026E516E-B814-414B-83CD-856D6FEF4822},2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},26"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},6"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},1"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\CAPTURE\{0E9E1341-75F5-4DEE-8849-333AD2A6F012}\PROPERTIES"; Key: "{1DA5D803-D492-4EDD-8C23-E0C0FFEE7F0E},0"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "WAVEMAPPER"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DRIVERS32"; Key: "MIDIMAPPER"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: "DISABLE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\DATASTORE_V1.0"; Key: "DATAFILEPATH"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE1"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE3"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE4"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE5"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE6"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE7"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE8"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE9"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE10"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE11"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE12"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE13"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE14"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE15"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\LANGUAGEPACK\SURROGATEFALLBACK"; Key: "PLANE16"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKCU\KEYBOARD LAYOUT\TOGGLE"; Key: "LANGUAGE HOTKEY"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKCU\KEYBOARD LAYOUT\TOGGLE"; Key: "HOTKEY"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKCU\KEYBOARD LAYOUT\TOGGLE"; Key: "LAYOUT HOTKEY"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{12D83BD7-CF12-46BE-8540-812710D3021C},1"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{B3F8FA53-0004-438E-9003-51A46E139BFC},22"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: ""; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}"; Key: "APPID"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MMDEVICES\AUDIO\RENDER\{AFE9D18C-BC79-401B-8755-E68EE7C32C02}\PROPERTIES"; Key: "{9C119480-DDC2-4954-A150-5BD240D454AD},1"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\1"; Key: "IDTYPE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\1"; Key: "TRANSPORT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\1"; Key: "QUERYFILE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\1"; Key: "NOSTATEFILE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\10"; Key: "IDTYPE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\10"; Key: "TRANSPORT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\10"; Key: "UUID"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\2"; Key: "IDTYPE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\2"; Key: "TRANSPORT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\2"; Key: "QUERYFILE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\2"; Key: "NOSTATEFILE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\3"; Key: "IDTYPE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\3"; Key: "TRANSPORT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\3"; Key: "QUERYFILE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\3"; Key: "NOSTATEFILE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\4"; Key: "IDTYPE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\4"; Key: "TRANSPORT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\4"; Key: "QUERYFILE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\4"; Key: "NOSTATEFILE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\5"; Key: "IDTYPE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\5"; Key: "TRANSPORT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\5"; Key: "UUID"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\6"; Key: "IDTYPE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\6"; Key: "TRANSPORT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\6"; Key: "UUID"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\7"; Key: "IDTYPE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\7"; Key: "TRANSPORT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\7"; Key: "QUERYFILE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\7"; Key: "NOSTATEFILE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\8"; Key: "IDTYPE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\8"; Key: "TRANSPORT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\8"; Key: "DLLNAME"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\8"; Key: "DEVQUERYENTRY"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\9"; Key: "IDTYPE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\9"; Key: "TRANSPORT"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\9"; Key: "DLLNAME"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVQUERY\9"; Key: "DEVQUERYENTRY"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "6E7B1892-5288-5FE5-8F34-E3B0DC671FD2"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\MULTIMEDIA\AUDIO"; Key: "USERDUCKINGPREFERENCE"; Value: "") "3_Activation_Keygen.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\AUDIO"; Key: "SKIPRTHEAP"; Value: "")41:T323c,"3_Activation_Keygen.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "3_Activation_Keygen.exe" trying to touch file "C:\3_Activation_Keygen.exe" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "3_Activation_Keygen.exe" trying to touch file "C:\WINMM.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\winmm.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINMMBASE.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\winmmbase.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\cfgmgr32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\bcryptprimitives.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\cryptbase.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\sspicli.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\rpcrt4.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\combase.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\FLTLIB.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\fltLib.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\ws2_32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\windows\temp\VxOle32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\advapi32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\ole32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\oleaut32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\system32\oleaut32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernelbase.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\ole32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\system32\uxtheme.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\msctf.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\RPCSS.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\system32\rpcss.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\kernel.appcore.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\TextInputFramework.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\System32\TextInputFramework.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\CoreUIComponents.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\System32\CoreUIComponents.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\CoreMessaging.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\System32\CoreMessaging.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\ntmarta.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\ntmarta.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\WinTypes.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\wintypes.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\SHCore.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\Globalization\Sorting\SortDefault.nls" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\user32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\dwmapi.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\system32\dwmapi.dll" "3_Activation_Keygen.exe" trying to touch file "C:\MMDEVAPI.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\MMDevAPI.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\MMDevAPI.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MMDevAPI.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\devobj.dll" "3_Activation_Keygen.exe" trying to touch file "C:\PROPSYS.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\PROPSYS.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\propsys.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\PROPSYS.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WDMAUD.DRV" "3_Activation_Keygen.exe" trying to touch file "C:\wdmaud.drv" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\wdmaud.drv" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\wdmaud.drv" "3_Activation_Keygen.exe" trying to touch file "C:\KSUSER.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\ksuser.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\ksuser.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\ksuser.dll" "3_Activation_Keygen.exe" trying to touch file "C:\AVRT.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\AVRT.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\avrt.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\AVRT.dll" "3_Activation_Keygen.exe" trying to touch file "wdmaud.drv" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\en-US\wdmaud.drv.mui" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\en-US\MMDevAPI.dll.mui" "3_Activation_Keygen.exe" trying to touch file "C:\AUDIOSES.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\AudioSes.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\AUDIOSES.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\powrprof.dll" "3_Activation_Keygen.exe" trying to touch file "C:\MSACM32.DRV" "3_Activation_Keygen.exe" trying to touch file "C:\msacm32.drv" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\msacm32.drv" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\msacm32.drv" "3_Activation_Keygen.exe" trying to touch file "C:\MSACM32.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\MSACM32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\msacm32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSACM32.dll" "3_Activation_Keygen.exe" trying to touch file "C:\MIDIMAP.DLL" "3_Activation_Keygen.exe" trying to touch file "C:\midimap.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\midimap.dll" "3_Activation_Keygen.exe" trying to touch file "C:\WINDOWS\SYSTEM32\midimap.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\SysWOW64\clbcatq.dll" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\Registration\R00000000000d.clb" "3_Activation_Keygen.exe" trying to touch file "C:\Windows\Fonts\StaticCache.dat" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\System32\WOW64LOG.DLL" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\ntdll.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\kernel32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\apppatch\sysmain.sdb" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\apphelp.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\ucrtbase.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\msvcp_win.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\win32u.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\gdi32full.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\gdi32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\msvcrt.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\cfgmgr32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\winmmbase.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\winmm.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\bcryptprimitives.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\cryptbase.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\sechost.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\sspicli.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\rpcrt4.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\combase.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\imm32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\ws2_32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\fltLib.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\Temp\VxSSL32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\advapi32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\Temp\VxOle32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\oleaut32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\ole32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\uxtheme.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\msctf.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\RPCSS.DLL" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\kernel.appcore.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\ntmarta.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\CoreMessaging.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\WinTypes.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\SHCore.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\CoreUIComponents.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\TextInputFramework.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\Globalization\Sorting\SortDefault.nls" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\user32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\dwmapi.dll" "3_Activation_Keygen.exe" trying to touch file "C:\DEVOBJ.DLL" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\devobj.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\propsys.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\MMDevAPI.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\ksuser.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\avrt.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\en-US\wdmaud.drv.mui" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\en-US\MMDevAPI.dll.mui" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\powrprof.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\AudioSes.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\KernelBase.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\wdmaud.drv" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\msacm32.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\msacm32.drv" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\midimap.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\SysWOW64\clbcatq.dll" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\Registration\R00000000000d.clb" "3_Activation_Keygen.exe" trying to touch file "%WINDIR%\Fonts\StaticCache.dat"42:T664,"3_Activation_Keygen.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\WINMM.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\FLTLIB.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "3_Activation_Keygen.exe" trying to access non-existent file "C:\MMDEVAPI.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\MMDevAPI.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\Windows\SysWOW64\devobj.dll" "3_Activation_Keygen.exe" trying to access non-existent file "C:\PROPSYS.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\PROPSYS.dll" "3_Activation_Keygen.exe" trying to access non-existent file "C:\KSUSER.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\ksuser.dll" "3_Activation_Keygen.exe" trying to access non-existent file "C:\AVRT.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\AVRT.dll" "3_Activation_Keygen.exe" trying to access non-existent file "C:\AUDIOSES.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\MSACM32.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\MSACM32.dll" "3_Activation_Keygen.exe" trying to access non-existent file "C:\MIDIMAP.DLL" "3_Activation_Keygen.exe" trying to access non-existent file "C:\midimap.dll"43:T756,"3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\windows\\temp\\VxOle32.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\oleaut32.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\kernelbase.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\ole32.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\uxtheme.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\rpcss.dll" "$status": "c0000034"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\System32\\TextInputFramework.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\System32\\CoreUIComponents.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\System32\\CoreMessaging.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\ntmarta.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\wintypes.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\user32.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\system32\\dwmapi.dll"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\MMDevAPI.DLL" "$status": "c0000034"} "3_Activation_Keygen.exe" called "NtQueryAttributesFile" with parameters {"$name": "C:\\WINDOWS\\SYSTEM32\\MMDevAPI.DLL"}44:Te13,Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp")45:T50d,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp")46:T4a4,Found string "\Device\" (Indicator: "\Device\"; Source: "00000000-00008040.00000000.78323.00508000.00000004.mdmp, 00000000-00008040.00000001.80240.00508000.00000004.mdmp, 00000000-00008040.00000002.82163.00508000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp") Found string "e68ee7c32c02}|\Device\HarddiskVolume2\3_Activation_Keygen.exe%b{00000000-0000-0000-0000-000000000000}|1%b8040" (Indicator: "\Device\"; Source: "00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp") Found string "{0.0.0.00000000}.{afe9d18c-bc79-401b-8755-e68ee7c32c02}|\Device\HarddiskVolume2\3_Activation_Keygen.exe%b{00000000-0000-0000-0000-000000000000}|1%b8040" (Indicator: "\Device\"; Source: "00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp")47:T427,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp")48:T1c16,"3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "392" "processHandle": "4294967295" "baseAddress": "2971830" "zeroBits": "0" "commitSize": "0" "viewSize": "299008" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "396" "processHandle": "4294967295" "baseAddress": "2970f40" "zeroBits": "0" "commitSize": "0" "viewSize": "491520" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "396" "processHandle": "4294967295" "baseAddress": "2971150" "zeroBits": "0" "commitSize": "0" "viewSize": "1011712" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "396" "processHandle": "4294967295" "baseAddress": "2970910" "zeroBits": "0" "commitSize": "0" "viewSize": "602112" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "388" "processHandle": "4294967295" "baseAddress": "60eef8" "zeroBits": "0" "commitSize": "0" "viewSize": "32768" "inheritDisposition": "1" "allocationType": "0" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "428" "processHandle": "4294967295" "baseAddress": "2971360" "zeroBits": "0" "commitSize": "0" "viewSize": "495616" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "432" "processHandle": "4294967295" "baseAddress": "2971200" "zeroBits": "0" "commitSize": "0" "viewSize": "1327104" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "436" "processHandle": "4294967295" "baseAddress": "2970a70" "zeroBits": "0" "commitSize": "0" "viewSize": "57344" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "472" "processHandle": "4294967295" "baseAddress": "29712b0" "zeroBits": "0" "commitSize": "0" "viewSize": "487424" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "472" "processHandle": "4294967295" "baseAddress": "2970bd0" "zeroBits": "0" "commitSize": "0" "viewSize": "2310144" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "476" "processHandle": "4294967295" "baseAddress": "2994878" "zeroBits": "0" "commitSize": "0" "viewSize": "557056" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "472" "processHandle": "4294967295" "baseAddress": "2970d30" "zeroBits": "0" "commitSize": "0" "viewSize": "573440" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "472" "processHandle": "4294967295" "baseAddress": "2970de0" "zeroBits": "0" "commitSize": "0" "viewSize": "163840" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "472" "processHandle": "4294967295" "baseAddress": "2994c98" "zeroBits": "0" "commitSize": "0" "viewSize": "831488" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "616" "processHandle": "4294967295" "baseAddress": "2995428" "zeroBits": "0" "commitSize": "0" "viewSize": "143360" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "664" "processHandle": "4294967295" "baseAddress": "2995b08" "zeroBits": "0" "commitSize": "0" "viewSize": "372736" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "664" "processHandle": "4294967295" "baseAddress": "29954d8" "zeroBits": "0" "commitSize": "0" "viewSize": "139264" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "664" "processHandle": "4294967295" "baseAddress": "2995638" "zeroBits": "0" "commitSize": "0" "viewSize": "1548288" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "704" "processHandle": "4294967295" "baseAddress": "2994928" "zeroBits": "0" "commitSize": "0" "viewSize": "237568" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "704" "processHandle": "4294967295" "baseAddress": "2994718" "zeroBits": "0" "commitSize": "0" "viewSize": "28672" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "704" "processHandle": "4294967295" "baseAddress": "2994ea8" "zeroBits": "0" "commitSize": "0" "viewSize": "32768" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "748" "processHandle": "4294967295" "baseAddress": "2995168" "zeroBits": "0" "commitSize": "0" "viewSize": "999424" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "724" "processHandle": "4294967295" "baseAddress": "2995008" "zeroBits": "0" "commitSize": "0" "viewSize": "282624" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "744" "processHandle": "4294967295" "baseAddress": "29958f8" "zeroBits": "0" "commitSize": "0" "viewSize": "40960" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"} "3_Activation_Keygen.exe" called "NtMapViewOfSection" with parameters {"sectionHandle": "744" "processHandle": "4294967295" "baseAddress": "29947c8" "zeroBits": "0" "commitSize": "0" "viewSize": "102400" "inheritDisposition": "1" "allocationType": "8388608" "win32Protect": "4"}49:T1031,"3_Activation_Keygen.exe" wrote bytes "b0848f72a0aa917250858f7280878f72f0868f72" to virtual address "0x76C14000" (part of module "MSCTF.DLL") "3_Activation_Keygen.exe" wrote bytes "801f0077a05a0177e0940177d07b0177b01e0077d01d0077f0e30377703f017750fafe76a080ff76" to virtual address "0x74F4E138" (part of module "GDI32.DLL") "3_Activation_Keygen.exe" wrote bytes "a0908176b024857680498176c0d4847660da847620f48376b0f88376304e847620ec83766058817620918176d0f2837650cf8476b024857640fc847650458276b0458276d0fc8976c0ee8376" to virtual address "0x770F4000" (part of module "CFGMGR32.DLL") "3_Activation_Keygen.exe" wrote bytes "f04c0177c056017730080177c0610077606e017700550177504f0177f0430177501a017750b50377c01b0177f031017750670177" to virtual address "0x74F4E164" (part of module "GDI32.DLL") "3_Activation_Keygen.exe" wrote bytes "1041bb73" to virtual address "0x7222F070" (part of module "WINMMBASE.DLL") "3_Activation_Keygen.exe" wrote bytes "907c0177002b01770039017770a20177b0af0177708cfe765074fe76d0d0037760af017780800177b0840177f05f017730a30177" to virtual address "0x74F4E060" (part of module "GDI32.DLL") "3_Activation_Keygen.exe" wrote bytes "30ae9476" to virtual address "0x768C1094" (part of module "RPCRT4.DLL") "3_Activation_Keygen.exe" wrote bytes "70f00c75909705758004077550070a75106e0775606e0775a0f90c7560f80c75603c0b75b0ff0a75003d0d75608a0575b0ff077500910575b0f0067590410d7500410d75" to virtual address "0x72102008" (part of module "MMDEVAPI.DLL") "3_Activation_Keygen.exe" wrote bytes "705bf374906af3744037f374f06bf3747068f374d06af374e045f374e03af374e068f374b069f374b06bf374b055f374506af374b071f374406bf3743069f374806df374707af3749037f374" to virtual address "0x7559D000" (part of module "IMM32.DLL") "3_Activation_Keygen.exe" wrote bytes "209cc976b038c97660fcc876f0c3c976d004c9764006c976" to virtual address "0x7222F078" (part of module "WINMMBASE.DLL") "3_Activation_Keygen.exe" wrote bytes "606e0775b0f00675106e077570f00c75" to virtual address "0x7222F038" (part of module "WINMMBASE.DLL") "3_Activation_Keygen.exe" wrote bytes "d0d0607690d16076" to virtual address "0x751F00C4" (part of module "COMBASE.DLL") "3_Activation_Keygen.exe" wrote bytes "10061a77" to virtual address "0x729E0000" (part of module "TEXTINPUTFRAMEWORK.DLL") "3_Activation_Keygen.exe" wrote bytes "600bb676" to virtual address "0x729E003C" (part of module "TEXTINPUTFRAMEWORK.DLL") "3_Activation_Keygen.exe" wrote bytes "00890177" to virtual address "0x74F4E010" (part of module "GDI32.DLL") "3_Activation_Keygen.exe" wrote bytes "80539a7250f6977270ed9972" to virtual address "0x76C14024" (part of module "MSCTF.DLL") "3_Activation_Keygen.exe" wrote bytes "10760177a05f017730d5fe76f056fe76a0e70377e07bfe76b0d60377b024ff7610450177204d017790e50377" to virtual address "0x74F4E19C" (part of module "GDI32.DLL") "3_Activation_Keygen.exe" wrote bytes "90dd0c77504e0c77904e0c77f0db0c77305f0c7790db0c77c03f0c77" to virtual address "0x72102078" (part of module "MMDEVAPI.DLL") "3_Activation_Keygen.exe" wrote bytes "d0e40177c0e40177a0dc017720b1017790af0177f0560177e086057720c7017740ec017720ee0177" to virtual address "0x74F4E958" (part of module "GDI32.DLL") "3_Activation_Keygen.exe" wrote bytes "d05ffe76007efe76905c017740980177e0a1fe7620680177d0d5fe76104efe767034fe763071fe7600310177807401774012017720420177e0af0177" to virtual address "0x74F4E098" (part of module "GDI32.DLL") "3_Activation_Keygen.exe" wrote bytes "7058017740c5037740820177009a04778078fe760073fe76d0140177707dfe76002d00776076fe7620770177c07cfe76904ffe761066017710360177a07e017770a2fe763036fe76" to virtual address "0x74F4E0D8" (part of module "GDI32.DLL") "3_Activation_Keygen.exe" wrote bytes "20e10e7280e10e72" to virtual address "0x7222F010" (part of module "WINMMBASE.DLL") "3_Activation_Keygen.exe" wrote bytes "e03a0177e0020177f03d0177" to virtual address "0x74F4E000" (part of module "GDI32.DLL") "3_Activation_Keygen.exe" wrote bytes "20830c7790c60c7780c50c7730de0c77" to virtual address "0x72102064" (part of module "MMDEVAPI.DLL") "3_Activation_Keygen.exe" wrote bytes "804fbb73b051bb734051bb73" to virtual address "0x721020A4" (part of module "MMDEVAPI.DLL")4a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiIiIiIiIiIiP/////////3AAAAAAAAAAAAAAAAAAAA9wAAAAAAAAAAAAAAAAAAAPcAAAAAAAAAAAAAAAAAAAD3AAAAAAAAAAAAAAAAAAAA9wAHcAAAAAAAf//////3APcAAIcAAAAAAP//////gAD3AAAIcAAAAAj//////wAA9wMwBIAAAwB///////cAAPcDdwB4AAAAj/////9wAAD3c3cwB3AAB//////4AAAAh3d3cAB3AA//////9wAAAId3d3cACHCP/////4AAAACHd3d3cACI//////8AAAAAh3d3d3cAf//////3AAAAAIB3d3d3AI//////gAAAAACAd3d3cAf//////wADAAAAgHd3dwAP//////gAMwAAAIB3d3cAj/////+IcAAAAACAd3dwB4//////cIcAMAAAgHd3MAiP////+AAIYAcwAHB3dwB4iP///4AABoAAcwBwd3AHiIiIiIhwBwB4AAcAcHdwCIiIiIiIAHcwB3AAcHB3AHiIiIiIhwB3cACHAHdwcAeIiIiIiHAHd3cACAB3cHcAAAAAAAAAB3d3cAAAd3B3cAAAAAAAAHd3d3cAB3dwd3d3d3d3d3d3d3d3d3d3cHd3d3c3d3d3d3d3d3d3d3B3d3MAB3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAHd3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==4b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiIiIiIiIiIiP/////////3AAAAAAAAAAAAAAAAAAAA9wAAAAAAAAAAAAAAAAAAAPcAAAAAAAAAAAAAAAAAAAD3AAAAAAAAAAAAAAAAAAAA9wAHcAAAAAAAf//////3APcAAIcAAAAAAP//////gAD3AAAIcAAAAAj//////wAA9wMwBIAAAwB///////cAAPcDdwB4AAAAj/////9wAAD3c3cwB3AAB//////4AAAAh3d3cAB3AA//////9wAAAId3d3cACHCP/////4AAAACHd3d3cACI//////8AAAAAh3d3d3cAf//////3AAAAAIB3d3d3AI//////gAAAAACAd3d3cAf//////wADAAAAgHd3dwAP//////gAMwAAAIB3d3cAj/////+IcAAAAACAd3dwB4//////cIcAMAAAgHd3MAiP////+AAIYAcwAHB3dwB4iP///4AABoAAcwBwd3AHiIiIiIhwBwB4AAcAcHdwCIiIiIiIAHcwB3AAcHB3AHiIiIiIhwB3cACHAHdwcAeIiIiIiHAHd3cACAB3cHcAAAAAAAAAB3d3cAAAd3B3cAAAAAAAAHd3d3cAB3dwd3d3d3d3d3d3d3d3d3d3cHd3d3c3d3d3d3d3d3d3d3B3d3MAB3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAHd3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793954017595,"unified_at":"2026-11-06T08:33:37.595Z","metadata":{"hashes":{"sha256":"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21","sha1":"73d330be08cb9986defe3175b8116d4a22bf279c","md5":"1af76ef8857935eb1d8e46dc9cfe3729","sha512":"775240a7850461397fc9bc8c72cf6a675eeadf770bf9277abee4aba2aaeac1051f71c8bb31227fda45a8a153b6dac146b72836424d28318802624c3fbd8ad535","ssdeep":"1536:dYXmTrBviuTlhRFZD4eU8DcHaEDo7Ly6Sy6BxBnQbvM3fnouy8I5:dYXYrhhp1ZDLtGto3g2KPoutI","ssdeep_chunks":["1536:dYXmTrB","1536:YXmTrBv","1536:XmTrBvi","1536:mTrBviu","1536:TrBviuT","1536:rBviuTl","1536:BviuTlh","1536:viuTlhR","1536:iuTlhRF","1536:uTlhRFZ","1536:TlhRFZD","1536:lhRFZD4","1536:hRFZD4e","1536:RFZD4eU","1536:FZD4eU8","1536:ZD4eU8D","1536:D4eU8Dc","1536:4eU8DcH","1536:eU8DcHa","1536:U8DcHaE","1536:8DcHaED","1536:DcHaEDo","1536:cHaEDo7","1536:HaEDo7L","1536:aEDo7Ly","1536:EDo7Ly6","1536:Do7Ly6S","1536:o7Ly6Sy","1536:7Ly6Sy6","1536:Ly6Sy6B","1536:y6Sy6Bx","1536:6Sy6BxB","1536:Sy6BxBn","1536:y6BxBnQ","1536:6BxBnQb","1536:BxBnQbv","1536:xBnQbvM","1536:BnQbvM3","1536:nQbvM3f","1536:QbvM3fn","1536:bvM3fno","1536:vM3fnou","1536:M3fnouy","1536:3fnouy8","1536:fnouy8I","1536:nouy8I5","3072:dYXmTrB","3072:YXmTrBv","3072:XmTrBvi","3072:mTrBviu","3072:TrBviuT","3072:rBviuTl","3072:BviuTlh","3072:viuTlhR","3072:iuTlhRF","3072:uTlhRFZ","3072:TlhRFZD","3072:lhRFZD4","3072:hRFZD4e","3072:RFZD4eU","3072:FZD4eU8","3072:ZD4eU8D","3072:D4eU8Dc","3072:4eU8DcH","3072:eU8DcHa","3072:U8DcHaE","3072:8DcHaED","3072:DcHaEDo","3072:cHaEDo7","3072:HaEDo7L","3072:aEDo7Ly","3072:EDo7Ly6","3072:Do7Ly6S","3072:o7Ly6Sy","3072:7Ly6Sy6","3072:Ly6Sy6B","3072:y6Sy6Bx","3072:6Sy6BxB","3072:Sy6BxBn","3072:y6BxBnQ","3072:6BxBnQb","3072:BxBnQbv","3072:xBnQbvM","3072:BnQbvM3","3072:nQbvM3f","3072:QbvM3fn","3072:bvM3fno","3072:vM3fnou","3072:M3fnouy","3072:3fnouy8","3072:fnouy8I","3072:nouy8I5","1536:dYXYrhh","1536:YXYrhhp","1536:XYrhhp1","1536:Yrhhp1Z","1536:rhhp1ZD","1536:hhp1ZDL","1536:hp1ZDLt","1536:p1ZDLtG","1536:1ZDLtGt","1536:ZDLtGto","1536:DLtGto3","1536:LtGto3g","1536:tGto3g2","1536:Gto3g2K","1536:to3g2KP","1536:o3g2KPo","1536:3g2KPou","1536:g2KPout","1536:2KPoutI"],"imphash":"c7aaeea671e489e6c9e04d34e80606c1"},"file_info":{"file_name":"xf-mccs6.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":87040,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499292841000,"last_seen":1768840883000,"last_multi_scan":1768840883000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["fynloski","keygen","neshta","plimrost","quireap","floxif","generik","windows-server-utility"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":49},"sandbox_signatures":{"informative_count":101,"suspicious_count":18,"malicious_count":4,"total":123},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"HackTool/Win32.Keygen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"RiskWare/Win32.KeyGen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Keygen.34","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Tool.Genkryptik-9939783-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Keygen.HA potentially unsafe application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"HackTool.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"App/Keygen-WL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.DZU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_62.6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"ApplicUnsaf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/grayware_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API during runtime"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Loaded modules"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"tactic":"Persistence","technique":"Hijack Execution Flow","attack_id":"T1574","attack_id_wiki":"https://attack.mitre.org/techniques/T1574","identifiers":[{"type":"informative","value":"Loaded EXE module from outside of Windows folder"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Calls an API typically used to map section into the virtual address space of a process"},{"type":"informative","value":"Allocates virtual memory in a self process"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to opens the access token associated with a thread"},{"type":"informative","value":"Calls an API typically used to opens the access token associated with a process"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"YARA signature match - Cryptography Rijndael"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"YARA signature match - AES Encryption"},{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API typically to used to retrieve file or directory information"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Queries basic process information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to create string binding handle (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"References OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Calls an API typically used to terminate process and its threads"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00011888-00003876-19970-250-00419FA1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011888-00003876-19970-316-0041ED76\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011888-00003876-19970-1577-0041D1D6","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00011888-00003876-19970-531-0041E0F1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$36","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.exe.bin\" was detected as \"UPX v1.25 (Delphi) Stub\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.98591886484","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.exe.bin\" has a section named \"UPX0\"\n \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.exe.bin\" has a section named \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"nv@9.v\"\n Pattern match: \"appro@openssl.org\"","origin":"File/Memory","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.exe.bin\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n VirtualAlloc\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"38/67 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"38/67 Antivirus vendors marked sample as malicious (56% detection rate)\n 6/14 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"AudioSrv\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt\"\n \"Local\\MidiMapper_modLongMessage_RefCnt\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008040.00000000.78323.02960000.00000004.mdmp, 00000000-00008040.00000001.80240.02960000.00000004.mdmp, 00000000-00008040.00000002.82163.02960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00008040.00000000.78323.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008040.00000001.80240.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00008040.00000002.82163.00400000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor byte ptr [edi-2Bh]\n ah in Stream UID: 00000000-00008040-7673-333-0041FDD4\n Assembly shows XOR instruction xor byte ptr [edi+72C075D5h]\n al in Stream UID: 00000000-00008040-7673-333-0041FDD4\n Assembly shows XOR instruction xor dword ptr [ecx-370C8F8Dh]\n 76h in Stream UID: 00000000-00008040-7673-333-0041FDD4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"q q ^ ^ 8 8 % %\" (Indicator: \" ^ \"; Source: \"00000000-00008040.00000001.80240.05930000.00000004.mdmp\")\n Found string \"^ ^ y y f f S S - -\" (Indicator: \" ^ \"; Source: \"00000000-00008040.00000002.82163.05930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Found XOR operators (encryption/decryption)\n Matched sigs: YARA signature match - Cryptography Rijndael\n Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption and can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES Encryption\n Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"3_Activation_Keygen.exe\" called \"RtlGetNtProductType\" (UID: 00000000-00008040)\n \"3_Activation_Keygen.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"3_Activation_Keygen.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"3_Activation_Keygen.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"3_Activation_Keygen.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008040)\n \"3_Activation_Keygen.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008040)\n \"3_Activation_Keygen.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008040)\n \"3_Activation_Keygen.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00008040)\n \"3_Activation_Keygen.exe\" called \"LoadLibrary\" with a parameter KERNEL32.DLL (UID: 00000000-00008040)\n \"3_Activation_Keygen.exe\" called \"LoadLibrary\" with a parameter GDI32.dll (UID: 00000000-00008040)\n \"3_Activation_Keygen.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00008040)\n \"3_Activation_Keygen.exe\" called \"LoadLibrary\" with a parameter WINMM.dll (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$39","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"Found reference to native API (Indicator: \"RtlUnwind\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3c","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"General","name":"Loaded EXE module from outside of Windows folder","description":"\"3_Activation_Keygen.exe\" loaded module \"C:\\3_Activation_Keygen.exe\" at 00400000","origin":"Loaded Module","mitre_attack_id":"T1574","relevance":1,"id":"module-13","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"General","name":"Loaded modules","description":"$3d","origin":"Loaded Module","mitre_attack_id":"T1574.002","id":"module-11","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"3_Activation_Keygen.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76930000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"3_Activation_Keygen.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76810000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" was detected as \"UPX\" and name: \"Packer\"\n \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"3_Activation_Keygen.exe\" touched \"MMDeviceEnumerator class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{BCDE0395-E52F-467C-8E3D-C4579291692E}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has an executable section named \"UPX0\"\n \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has an writable section named \"UPX0\"\n \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has an writable section named \"UPX1\"\n \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has an writable section named \".rsrc\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" file has an entrypoint instructions - \"pushal\t,mov\tesi, 0x48c000,lea\tedi, [esi - 0x8b000],push\tedi,mov\tebp, esp,lea\tebx, [esp - 0x3e80],xor\teax, eax,push\teax,cmp\tesp, ebx,jne\t0x49e918,inc\tesi,inc\tesi,push\tebx,push\t0x9c85d,push\tedi,add\tebx, 4,push\tebx,push\t0x128fb,push\tesi,add\tebx, 4,push\tebx,push\teax,mov\tdword ptr [ebx], 3,nop\t,nop\t,nop\t,nop\t,nop\t,push\tebp,push\tedi,push\tesi,push\tebx,sub\tesp, 0x7c,mov\tedx, dword ptr [esp + 0x90],mov\tdword ptr [esp + 0x74], 0,mov\tbyte ptr [esp + 0x73], 0,mov\tebp, dword ptr [esp + 0x9c],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\"3_Activation_Keygen.exe\" allocated memory in \"C:\\3_Activation_Keygen.exe\" with (Protection: \"read/write\")\n \"3_Activation_Keygen.exe\" allocated memory in \"C:\\3_Activation_Keygen.exe\" with (Protection: \"no access\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"3_Activation_Keygen.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic process information of the specified process","description":"\"3_Activation_Keygen.exe\" queries basic process information of the \"C:\\3_Activation_Keygen.exe\" (UID: 8040)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"3_Activation_Keygen.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"3_Activation_Keygen.exe\" trying to access non-existent file \"C:\\WDMAUD.DRV\"\n \"3_Activation_Keygen.exe\" trying to access non-existent file \"C:\\wdmaud.drv\"\n \"3_Activation_Keygen.exe\" trying to access non-existent file \"wdmaud.drv\"\n \"3_Activation_Keygen.exe\" trying to access non-existent file \"C:\\MSACM32.DRV\"\n \"3_Activation_Keygen.exe\" trying to access non-existent file \"C:\\msacm32.drv\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create string binding handle (RPC)","description":"\"3_Activation_Keygen.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-218","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\":\\windows\\system32\\midimap.dll\" [Source: 00000000-00008040.00000000.78323.02960000.00000004.mdmp\n 00000000-00008040.00000001.80240.02960000.00000004.mdmp\n 00000000-00008040.00000002.82163.02960000.00000004.mdmp]\n Observed email domain:\"idimap.dll\" [Source: 00000000-00008040.00000000.78323.02960000.00000004.mdmp\n 00000000-00008040.00000001.80240.02960000.00000004.mdmp\n 00000000-00008040.00000002.82163.02960000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00008040.00000000.78323.02960000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00008040.00000001.80240.02960000.00000004.mdmp\")\n Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00008040.00000002.82163.02960000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Network Related","name":"References OpenSSL library string","description":"Observed string: \"AES part of OpenSSL 1.0.1c 10 May 2012\" (Indicator: \"OpenSSL 1.\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-5003","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES Encryption","description":"YARA signature for AES encryption matched on process \"00000000-00008040\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00008040\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"\"3_Activation_Keygen.exe\" called \"NtOpenProcessToken\" (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"\"3_Activation_Keygen.exe\" called \"NtOpenThreadToken\" (UID: 00000000-00008040)","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000000.78323.004A0000.00000004.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.004A0000.00000004.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.004A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"128635352103,7696,104,,GetKeyState,user32.dll,\"00:21:12.687\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00008040.00000002.82163.02960000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to terminate process and its threads","description":"\"3_Activation_Keygen.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\3_Activation_Keygen.exe\"}","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-247","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$46","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to map section into the virtual address space of a process","description":"$48","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-259","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found string \"winlogon.exe\" (Indicator: \"svchost.exe,smss.exe,csrss.exe,wininit.exe,winlogon.exe\"; Source: \"00000000-00008040.00000000.78323.02910000.00000004.mdmp, 00000000-00008040.00000001.80240.02910000.00000004.mdmp, 00000000-00008040.00000002.82163.02910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"3_Activation_Keygen.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"3_Activation_Keygen.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"3_Activation_Keygen.exe\" queried SystemProcessInformation at 00000000-00008040-00000C13-77293787 [PID: 8040]\n \"3_Activation_Keygen.exe\" queried SystemProcessInformation at 00000000-00008040-00000C13-77294741 [PID: 8040]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugPort","description":"\"3_Activation_Keygen.exe queries ProcessDebugPort (UID: 8040)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-238","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains CRYPTO related strings","description":"Found string \"P~AeS~AeS\" (Indicator: \"aes\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")\n Found string \"AES for x86, CRYPTOGAMS by \" (Indicator: \"aes\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")\n Found string \"AES part of OpenSSL 1.0.1c 10 May 2012\" (Indicator: \"aes\"; Source: \"00000000-00008040.00000000.78323.00401000.00000040.mdmp, 00000000-00008040.00000001.80240.00401000.00000040.mdmp, 00000000-00008040.00000002.82163.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has resource with unusual entropy \"RT_BITMAP:7.95079843475\"\n \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has resource with unusual entropy \"RT_BITMAP:7.956850264\"\n \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has resource with unusual entropy \"RT_BITMAP:7.96271552438\"\n \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has resource with unusual entropy \"RT_BITMAP:7.95681306891\"\n \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has resource with unusual entropy \"RT_BITMAP:7.17446226724\"\n \"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21.bin\" has resource with unusual entropy \"RT_BITMAP:7.20614608533\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Cryptography Rijndael","description":"YARA signature for Rijndael cipher used in process \"00000000-00008040\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-109","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00008040.00000000.78323.02910000.00000004.mdmp, 00000000-00008040.00000001.80240.02910000.00000004.mdmp, 00000000-00008040.00000002.82163.02910000.00000004.mdmp\")\n Found string \"WMIADAP.exe\" (Indicator: \"wmiadap.exe\"; in Source: \"00000000-00008040.00000000.78323.02910000.00000004.mdmp, 00000000-00008040.00000001.80240.02910000.00000004.mdmp, 00000000-00008040.00000002.82163.02910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"3_Activation_Keygen.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"3_Activation_Keygen.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"3_Activation_Keygen.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"3_Activation_Keygen.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"3_Activation_Keygen.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$49","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00008480.00000002.239484.00401000.00000040.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00008480.00000002.239484.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00008480.00000002.239484.00401000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00008480.00000002.239484.00401000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00008480.00000002.239484.00401000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00008480.00000002.239484.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.889718149307185","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008480-00000C29-2686797329\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00008480.00000002.239484.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"xf-mccs6.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 376 -p 8480 -ip 8480\" (UID: 00000000-00010508)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8480 -s 864\" (UID: 00000000-00007248)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WerFault.exe\" with commandline \"-pss -s 376 -p 8480 -ip 8480\" (UID: 00000000-00010508)\n Spawned process \"WerFault.exe\" with commandline \"-u -p 8480 -s 864\" (UID: 00000000-00007248)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"xf-mccs6.exe\" queries basic process information of the \"C:\\xf-mccs6.exe\" (UID: 8480)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /v2/content/6714383f9c181364553e97122fe149c2377f6820?partitionId=7&doClientVersion=10.1.0.7&altCatalogId=http%3A%2F%2F1D.tlu.dl.delivery.mp.microsoft.com%2Ffilestreamingservice%2Ffiles%2F4d89f0bf-5970-488a-9404-d601e3f368c9&profile=1048832&CacheId=7 HTTP/1.1Connection: Keep-Alive\n Accept: */*\n Accept-Encoding: gzip\n deflate\n User-Agent: Microsoft-Delivery-Optimization/10.1\n MS-CV: feBFvrahsEu4z8Nq.28.3.1.0.0.15.1.1.1.2.1.1\n Content-Length: 0\n Host: disc601.prod.do.dsp.mp.microsoft.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://disc601.prod.do.dsp.mp.microsoft.com/v2/content/6714383f9c181364553e97122fe149c2377f6820?partitionId=7&doClientVersion=10.1.0.7&altCatalogId=http%3A%2F%2F1D.tlu.dl.delivery.mp.microsoft.com%2Ffilestreamingservice%2Ffiles%2F4d89f0bf-5970-488a-9404-d601e3f368c9&profile=1048832&CacheId=7","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00008480\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"xf-mccs6.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"xf-mccs6.exe\" has section name UPX1 with entropy \"7.98591886484\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"},{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"},{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["fynloski","keygen","neshta","plimrost","quireap","floxif","generik","windows-server-utility"],"sample_flags":["User Comment","TOR analysis","Sample Crashed"],"sandbox_reports":[{"id":"672fba4268c030a53c036b30","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"xf-mccs6.exe","analysis_start_time":"2024-11-09T19:38:43+00:00","indicators_count":{"informative":73,"suspicious":13,"malicious":1},"tags":["Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"6464bd45aa80d0ae7b0fb12f","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Babar","submit_name":"3_Activation_Keygen.exe","analysis_start_time":"2023-05-17T11:48:50+00:00","indicators_count":{"informative":83,"suspicious":18,"malicious":3},"tags":["Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"5a8ee27a7ca3e1532c433623","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Keygen","submit_name":"xf-mccs6.exe","analysis_start_time":"2018-02-22T16:32:33+00:00","indicators_count":{"informative":9,"suspicious":9,"malicious":3},"tags":["User Comment","TOR analysis"],"is_in_unified_schema":true},{"id":"5a36538b86fe16cf2d0ebe80","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.GenericKD","submit_name":"xf-mccs6.exe","analysis_start_time":"2017-12-17T12:22:48+00:00","indicators_count":{"informative":6,"suspicious":9,"malicious":3},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"579cc48aaac2ed02538b35fd","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Keygen","submit_name":"xf-mccs6.exe","analysis_start_time":"2018-06-27T13:41:26+00:00","indicators_count":{"informative":8,"suspicious":9,"malicious":3},"tags":["Sample Crashed","User Comment"],"is_in_unified_schema":true},{"id":"56e2de8eaac2edb54b9a275f","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":90,"malware_family":"Application.Keygen","submit_name":"xf-mccs6.exe","analysis_start_time":"2016-03-11T09:05:17+00:00","indicators_count":{"informative":3,"suspicious":11,"malicious":4},"tags":["Sample Crashed","User Comment"],"is_in_unified_schema":false},{"id":"55d8d9a10e316d8c0a9908b0","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":76,"malware_family":"Application.Keygen","contacted_countries":["USA"],"submit_name":"xf-mccs6.exe","analysis_start_time":"2015-08-22T15:21:37+00:00","indicators_count":{"informative":3,"suspicious":6,"malicious":3},"tags":["Network Traffic","User Comment"],"is_in_unified_schema":false},{"id":"55d633d50e316d2221edadff","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":68,"malware_family":"Application.Keygen","submit_name":"xf-mccs6.exe","analysis_start_time":"2015-08-20T15:09:56+00:00","indicators_count":{"informative":1,"suspicious":5,"malicious":3},"tags":["User Comment"],"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}],"processes":[{"pid":8480,"ppid":0,"name":"xf-mccs6.exe","command_line":"","sha256":"ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21","normalized_path":"C:\\xf-mccs6.exe","uid":"00000000-00008480","icon":"$4a"},{"pid":7248,"ppid":8480,"name":"WerFault.exe","command_line":"-u -p 8480 -s 864","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00008480","uid":"00000000-00007248"},{"pid":10508,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 376 -p 8480 -ip 8480","sha256":"5cd3bb2e4b62180978f536450f48483107f74c8fcf8606c4beec01ef5d2cf01d","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00010508","icon":"$4b"}],"all_imported_dlls":["imm32.dll","msctf.dll","oleaut32.dll","avrt.dll","kernel32.dll","KernelBase.dll","gdi32.dll","msvcrt.dll","rpcss.dll","cryptbase.dll","ntdll.dll","dwmapi.dll","MMDevAPI.dll","propsys.dll","advapi32.dll","ksuser.dll","user32.dll","lpk.dll","usp10.dll","winmm.dll","uxtheme.dll","ole32.dll","rpcrt4.dll","sechost.dll","wow64.dll","clbcatq.dll","sspicli.dll","wow64win.dll","wow64cpu.dll","AudioSes.dll","devobj.dll","setupapi.dll","cfgmgr32.dll","shlwapi.dll","msacm32.dll","midimap.dll","SHCore.dll","winmmbase.dll","bcryptprimitives.dll","VxSSL32.dll","ntmarta.dll","WinTypes.dll","fltLib.dll","msvcp_win.dll","apphelp.dll","gdi32full.dll","combase.dll","powrprof.dll","TextInputFramework.dll","CoreUIComponents.dll","ws2_32.dll","kernel.appcore.dll","CoreMessaging.dll","ucrtbase.dll","win32u.dll","cryptsp.dll","wow64base.dll","wow64con.dll","TextShaping.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a8ee27a7ca3e1532c433623"},{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"},{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a36538b86fe16cf2d0ebe80"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"path":"C:\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"path":"%WINDIR%\\System32\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"path":"%WINDIR%\\System32\\en-US\\wdmaud.drv.mui","sources":[{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"path":"%WINDIR%\\System32\\en-US\\MMDevAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"name":"Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"579cc48aaac2ed02538b35fd"}]},{"name":"MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"name":"Local\\SM0:8040:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"name":"SM0:8040:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6464bd45aa80d0ae7b0fb12f"}]},{"name":"Local\\SM0:8480:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]},{"name":"SM0:8480:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"672fba4268c030a53c036b30"}]}]}},"report_ids":{"sandbox_job_ids":["672fba4268c030a53c036b30","5a36538b86fe16cf2d0ebe80","579cc48aaac2ed02538b35fd","6464bd45aa80d0ae7b0fb12f","5a8ee27a7ca3e1532c433623"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Win/grayware_confidence_100% Sample ac2d47dc2d33… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ac2d47dc2d33…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 13/27 AV engines flagged this file. 4 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/grayware_confidence_100% Sample ac2d47dc2d33… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ac2d47dc2d33…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 13/27 AV engines flagged this file. 4 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ac2d47dc2d33e6123da1f3ab00fea3a1659ce0f47266cc9ab004fa4b811f3b21"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/grayware_confidence_100% Sample ac2d47dc2d33… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ac2d47dc2d33…. Malware family: Win/grayware_confidence_100%. Threat score 100/100. 13/27 AV engines flagged this file. 4 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4c","11",{}]] 32:null